CVE-2022-47848
📋 TL;DR
This vulnerability allows remote attackers to bypass authentication and access sensitive information via the rootDesc.xml page of the UPnP service on affected Bezeq Vtech routers. Attackers can exploit this to gain unauthorized access to router configuration and potentially other sensitive data. Users of Bezeq Vtech NB403-IL and IAD604-IL routers with specific firmware versions are affected.
💻 Affected Systems
- Bezeq Vtech NB403-IL
- Bezeq Vtech IAD604-IL
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete router compromise allowing attackers to reconfigure network settings, intercept traffic, install malware, or use the router as a pivot point into the internal network.
Likely Case
Unauthorized access to router configuration, exposure of network credentials, and potential modification of DNS or firewall settings.
If Mitigated
Limited information disclosure if UPnP is disabled and proper network segmentation is in place.
🎯 Exploit Status
Exploitation involves simple HTTP requests to the UPnP service's rootDesc.xml endpoint without authentication.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: Not available
Restart Required: No
Instructions:
No official patch available. Check vendor website for firmware updates and apply if available.
🔧 Temporary Workarounds
Disable UPnP Service
allTurn off Universal Plug and Play service to prevent exploitation via the vulnerable endpoint.
Access router admin interface -> Advanced Settings -> UPnP -> Disable
Block External UPnP Access
linuxConfigure firewall to block external access to UPnP ports (typically 1900/udp and 5000/tcp).
iptables -A INPUT -p udp --dport 1900 -j DROP
iptables -A INPUT -p tcp --dport 5000 -j DROP
🧯 If You Can't Patch
- Isolate affected routers in a separate VLAN with strict firewall rules
- Implement network monitoring for unusual UPnP traffic patterns
🔍 How to Verify
Check if Vulnerable:
Access http://[router-ip]:5000/rootDesc.xml without authentication. If it returns router configuration data, the device is vulnerable.Check Version:
Check router web interface -> System Information -> Firmware VersionVerify Fix Applied:
Attempt to access the rootDesc.xml endpoint after applying workarounds. Should return authentication error or connection refused.📡 Detection & Monitoring
Log Indicators:
- Multiple unauthorized access attempts to /rootDesc.xml
- Unusual UPnP service activity
Network Indicators:
- External IP addresses accessing internal router UPnP ports
- Unusual traffic patterns to port 5000/tcp
SIEM Query:
source_ip=external AND dest_port=5000 AND uri_path="/rootDesc.xml"