CVE-2024-31970
📋 TL;DR
This vulnerability allows attackers to gain root-level access to AdTran SRG 834-5 devices during initial setup when SSH is enabled with default admin/admin credentials. Affected systems are AdTran SRG 834-5 devices running SmartOS 11.1.1.1, though the vendor disputes the exploitability from WAN interfaces.
💻 Affected Systems
- AdTran SRG 834-5 HDC17600021F1
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Complete device compromise allowing attackers to execute arbitrary commands, modify configurations, intercept traffic, or use the device as a pivot point into the network.
Likely Case
Unauthorized administrative access leading to configuration changes, service disruption, or credential harvesting from connected systems.
If Mitigated
Limited to internal network access attempts that fail due to proper credential management and network segmentation.
🎯 Exploit Status
Exploitation requires SSH access and knowledge of default credentials during setup window. Authentication is required but uses default credentials.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: SmartOS Version 12.1.3.1
Vendor Advisory: https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332
Restart Required: Yes
Instructions:
1. Download SmartOS Version 12.1.3.1 from AdTran support portal. 2. Backup current configuration. 3. Upload and apply the firmware update through the web interface or CLI. 4. Reboot the device. 5. Verify the update completed successfully.
🔧 Temporary Workarounds
Change Default Credentials Immediately
allChange admin password during initial setup before exposing device to network
configure terminal
username admin password <new_strong_password>
write memory
Disable SSH or Restrict Access
allDisable SSH if not needed or restrict to management network
configure terminal
no ip ssh server
write memory
🧯 If You Can't Patch
- Ensure SSH is not exposed to untrusted networks and restrict to management VLAN
- Implement strong password policy and change default credentials immediately after setup
🔍 How to Verify
Check if Vulnerable:
Check if device is running SmartOS 11.1.1.1 and SSH is enabled with default admin/admin credentialsCheck Version:
show versionVerify Fix Applied:
Verify device shows SmartOS Version 12.1.3.1 and SSH uses non-default credentials📡 Detection & Monitoring
Log Indicators:
- Failed SSH login attempts with admin username
- Successful SSH logins from unexpected sources
- Configuration changes during initial setup period
Network Indicators:
- SSH connection attempts to device on port 22 from unauthorized sources
- Unusual outbound connections from the device
SIEM Query:
source="adtran_srg" AND (event="ssh_login" AND user="admin") OR (event="config_change" AND phase="setup")🔗 References
- https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31970
- https://github.com/actuator/cve/blob/main/AdTran/SRG-834-5
- https://supportcommunity.adtran.com/t5/Security-Advisories/ADTSA-2024001-Multiple-vulnerabilities-in-Service-Delivery-Gateway-products/ta-p/39332
- https://github.com/actuator/cve/blob/main/AdTran/CVE-2024-31970
- https://github.com/actuator/cve/blob/main/AdTran/SRG-834-5
