CVE-2023-0345
📋 TL;DR
The Akuvox E11 device has SSH enabled by default with a hardcoded root password that cannot be changed. This allows attackers to gain full administrative control over affected devices. Organizations using Akuvox E11 devices are affected.
💻 Affected Systems
- Akuvox E11
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise leading to data theft, device takeover for botnet participation, or lateral movement into connected networks.
Likely Case
Unauthorized access to device configuration, potential data exfiltration, and device manipulation.
If Mitigated
Limited impact if SSH is disabled or network access is restricted, though default configuration remains vulnerable.
🎯 Exploit Status
Exploitation requires only SSH client and knowledge of default credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check vendor for latest firmware
Vendor Advisory: https://www.cisa.gov/news-events/ics-advisories/icsa-23-068-01
Restart Required: Yes
Instructions:
1. Check Akuvox website for latest firmware. 2. Download and apply firmware update. 3. Verify SSH is disabled or credentials are changed.
🔧 Temporary Workarounds
Disable SSH Service
linuxCompletely disable SSH server if not required for operations
systemctl stop ssh
systemctl disable ssh
Network Access Control
linuxRestrict SSH access to trusted IP addresses only
iptables -A INPUT -p tcp --dport 22 -s TRUSTED_IP -j ACCEPT
iptables -A INPUT -p tcp --dport 22 -j DROP
🧯 If You Can't Patch
- Isolate affected devices in separate network segment with strict firewall rules
- Monitor all SSH connection attempts and alert on unauthorized access
🔍 How to Verify
Check if Vulnerable:
Attempt SSH connection to port 22 using default credentials (check vendor advisory for specific credentials)Check Version:
Check device web interface or use vendor-specific CLI commandsVerify Fix Applied:
Verify SSH connection fails with default credentials and/or SSH service is disabled📡 Detection & Monitoring
Log Indicators:
- Failed SSH authentication attempts
- Successful SSH logins from unexpected sources
- Multiple SSH connection attempts
Network Indicators:
- SSH traffic to port 22 from unauthorized IPs
- Unusual SSH session durations or data transfers
SIEM Query:
source="ssh" AND (event="authentication success" OR event="authentication failure") | stats count by src_ip