CVE-2023-41355
📋 TL;DR
This vulnerability in Chunghwa Telecom NOKIA G-040W-Q routers allows unauthenticated remote attackers to send crafted ICMP redirect messages to manipulate network routing tables. Attackers can cause denial of service or intercept sensitive network traffic. Only users of these specific routers are affected.
💻 Affected Systems
- Chunghwa Telecom NOKIA G-040W-Q
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete network disruption with traffic interception, allowing attackers to redirect all network traffic through malicious systems for man-in-the-middle attacks and data theft.
Likely Case
Partial network disruption and traffic redirection to attacker-controlled systems, potentially exposing credentials and sensitive data.
If Mitigated
Limited impact if ICMP redirects are filtered at network perimeter or routing tables are protected.
🎯 Exploit Status
Exploitation requires sending specially crafted ICMP redirect packets to the vulnerable device.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Check with vendor for specific patched version
Vendor Advisory: https://www.twcert.org.tw/tw/cp-132-7505-a0c94-1.html
Restart Required: Yes
Instructions:
1. Contact Chunghwa Telecom or NOKIA for firmware update. 2. Download latest firmware. 3. Apply update through router admin interface. 4. Reboot router.
🔧 Temporary Workarounds
Block ICMP Redirects at Network Perimeter
linuxConfigure upstream firewalls to block incoming ICMP redirect messages
iptables -A INPUT -p icmp --icmp-type redirect -j DROP
Disable ICMP Redirect Processing
linuxConfigure systems to ignore ICMP redirects if supported
sysctl -w net.ipv4.conf.all.accept_redirects=0
sysctl -w net.ipv6.conf.all.accept_redirects=0
🧯 If You Can't Patch
- Isolate vulnerable devices in separate network segments with strict access controls
- Implement network monitoring for ICMP redirect traffic and unauthorized routing changes
🔍 How to Verify
Check if Vulnerable:
Check if device is NOKIA G-040W-Q and test with ICMP redirect packetsCheck Version:
Check router web interface or use SNMP to query system versionVerify Fix Applied:
Verify firmware version is updated and test that ICMP redirects no longer affect routing📡 Detection & Monitoring
Log Indicators:
- Unusual ICMP redirect messages in firewall logs
- Unexpected routing table changes
Network Indicators:
- Spike in ICMP redirect traffic to router
- Unauthorized routing advertisements
SIEM Query:
source_ip=* AND icmp_type=redirect AND dest_ip=[router_ip]