CVE-2022-29730
📋 TL;DR
USR IOT 4G LTE Industrial Cellular VPN Router v1.0.36 contains hard-coded administrative credentials that cannot be changed through normal device operation. This allows attackers to gain full administrative control of affected routers. Organizations using these specific industrial VPN routers are affected.
💻 Affected Systems
- USR IOT 4G LTE Industrial Cellular VPN Router
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of industrial network infrastructure, allowing attackers to intercept VPN traffic, modify router configurations, pivot to internal networks, and disrupt industrial operations.
Likely Case
Unauthorized administrative access leading to network reconnaissance, data interception, and potential lateral movement into connected industrial control systems.
If Mitigated
Limited impact if routers are behind firewalls with strict network segmentation and access controls preventing external exploitation.
🎯 Exploit Status
Hard-coded credentials are publicly documented, making exploitation trivial for anyone with network access to the device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.pusr.com/
Restart Required: No
Instructions:
No official patch available. Contact vendor for updated firmware or mitigation guidance.
🔧 Temporary Workarounds
Network Segmentation
allIsolate affected routers in dedicated network segments with strict firewall rules preventing external access.
Access Control Lists
allImplement network ACLs to restrict administrative access to trusted IP addresses only.
🧯 If You Can't Patch
- Replace affected routers with different models that don't have hard-coded credentials
- Implement network monitoring and intrusion detection specifically for router administrative access attempts
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface or CLI. If version is 1.0.36, device is vulnerable.Check Version:
Check via web interface at http://[router-ip]/ or SSH to device and check firmware versionVerify Fix Applied:
Verify firmware has been updated to a version later than 1.0.36, or test that hard-coded credentials no longer work.📡 Detection & Monitoring
Log Indicators:
- Failed login attempts followed by successful login with default credentials
- Administrative configuration changes from unexpected sources
Network Indicators:
- Administrative access to router from unauthorized IP addresses
- Unusual VPN tunnel establishment patterns
SIEM Query:
source_ip=* AND destination_ip=[router-ip] AND (event_type="authentication_success" OR event_type="configuration_change")