CVE-2022-30114
📋 TL;DR
A heap-based buffer overflow vulnerability in Fastweb FASTGate routers allows remote attackers to cause denial-of-service by rebooting the device through crafted HTTP requests. This affects FASTGate MediaAccess FGA2130FWB and DGA4131FWB devices with specific firmware versions. The vulnerability is exploitable without authentication.
💻 Affected Systems
- Fastweb FASTGate MediaAccess FGA2130FWB
- Fastweb FASTGate DGA4131FWB
📦 What is this software?
Fastgate Gpon Fga2130fwb Firmware by Fastweb
⚠️ Risk & Real-World Impact
Worst Case
Complete device reboot causing extended service disruption, potential for remote code execution if buffer overflow can be controlled to execute arbitrary code
Likely Case
Device reboot causing temporary network outage (1-2 minutes) and service disruption
If Mitigated
No impact if device is patched or network controls prevent access to vulnerable service
🎯 Exploit Status
Public proof-of-concept demonstrates simple HTTP request triggering the buffer overflow; exploitation requires no authentication
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with Fastweb for latest firmware updates
Vendor Advisory: https://www.fastweb.it/myfastweb/assistenza/guide/FASTGate/
Restart Required: Yes
Instructions:
1. Log into Fastweb customer portal; 2. Check for firmware updates for your device model; 3. Download and apply the latest firmware; 4. Reboot the device after update
🔧 Temporary Workarounds
Block HTTP access to router management interface
linuxRestrict access to the router's HTTP management interface from untrusted networks
iptables -A INPUT -p tcp --dport 80 -j DROP
iptables -A INPUT -p tcp --dport 443 -j DROP
Disable remote management
allTurn off remote management features in router configuration
🧯 If You Can't Patch
- Place router behind a firewall that blocks inbound HTTP/HTTPS traffic to the device
- Use network segmentation to isolate vulnerable devices from untrusted networks
🔍 How to Verify
Check if Vulnerable:
Check router firmware version via web interface at http://[router-ip]/ or via SSH if enabledCheck Version:
curl -s http://[router-ip]/status.html | grep -i firmware || ssh admin@[router-ip] 'cat /etc/version'Verify Fix Applied:
Verify firmware version is newer than affected versions listed above📡 Detection & Monitoring
Log Indicators:
- Multiple device reboot events in router logs
- HTTP requests with unusually long or malformed parameters to management interface
Network Indicators:
- HTTP POST/GET requests to router IP on port 80/443 with large payloads
- Sudden loss of connectivity followed by device reboot
SIEM Query:
source="router_logs" AND (event="reboot" OR event="crash") AND http_request_size>1000