Sign-up

ID

VAR-201906-0823


CVE

CVE-2018-15555


TITLE

Telus Actiontec WEB6000Q Vulnerabilities related to authorization, authority, and access control in devices

Trust: 0.8

sources: JVNDB: JVNDB-2018-015802

DESCRIPTION

On Telus Actiontec WEB6000Q v1.1.02.22 devices, an attacker can login with root level access with the user "root" and password "admin" by using the enabled onboard UART headers. Telus Actiontec WEB6000Q The device contains vulnerabilities related to authorization, authority, and access control.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. Actiontec WEB6000Q is a wireless extender from American Actiontec. The Quantenna WiFi Controller in Telus Actiontec WEB6000Q 1.1.02.22 has a security vulnerability. Actiontec Electronics WEB6000Q is a wireless extender produced by Actiontec Electronics in the United States. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ### Device Details Discovered By: Andrew Klaus (andrew@aklaus.ca) Vendor: Actiontec (Telus Branded) Model: WEB6000Q Affected Firmware: 1.1.02.22 Reported: July 2018 CVE: CVE-2018-15555 (Main OS) CVE: CVE-2018-15556 (Quantenna OS) ### Summary of Findings Both “main” and “quantenna” have a UART header on the motherboard and each of them provide full shell + bootloader access. I used a Raspberry Pi to interface with the UART header, but there are USB UART adapters to do the same thing. Once root access is obtained, TR-069 Updating can be fully disabled, preventing the vendor from pushing updates to the device. ### Proof of Concept Hooking up a Raspberry Pi's UART GPIO header to either UART header on the modem will give a login prompt. root/admin or root/(nopass) depending on which modem header connected to. ### Enabling SSH daemon on Main OS After retrieving a root shell on the main OS over UART, SSH can be enabled by running the following: # cli -s Device.X_ACTIONTEC_COM_RemoteLogin.Enable int 1 iptables -A INPUT -p tcp --dport 22 -j ACCEPT dropbear -p 22 -I 1800 & $ ssh 192.168.1.2 -l admin -oKexAlgorithms=+diffie-hellman-group1-sha1 admin@192.168.1.2's password: BusyBox v1.17.2 (2016-02-03 21:34:18 PST) built-in shell (ash) Enter 'help' for a list of built-in commands. # -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE/rRUDraOzqmrp8tZoyRid8jQfpkFAlz9T5sACgkQoyRid8jQ fpnL1BAAi+Bu1xcK9thQ0AHqamY7DZ4qkP3dhFVUtW5q3hoJ4T3GOLTj/9RJLaOI J9FMvSMNAnTKtBcbTx4uvokRAbGLZEUPG1uk0Qu9wmC8tPliU0qHTCfU0vF2dFCI rrhmpaJhu4Y/AEIpjZXg1/5p5hIAQn5DfNUwu6p5VbDlRbktu5UELcFtvgnVi7Jq MUmNvPjbbxwfWlopb3kXASOh1SFLwe77AwmQmLQtIDknAyf2Ri9xfpf2wMGPqDTp WH3SzNCE+HkpHH8omSgnX+yA51KeGipUXWao3UnGvqdHp02TFz5OZIHhgzLk2AfX 6k78qy44DMegaUld9KQeW4OeVESxQqVu9goIjbRMIIlLKRsvz1BwTM+wBu74z2vU O8i1mzAPqloc8iIoIzLiu1dGzYTii4et6YMTq5GJiXL3PCTOJ8MR1/mxeebQwn9h ebsmkn0I06ruR37apz0WGBx0p7t158Pjzc954JoMLubQO8Isk/2G02wcekLLXjVj P2jxoJlnRplum7pKNQbfhAJ6VrGiyB9HY6VAarseqZzFLYJiL6u15EooKScVAg/0 ogZz/3G4m8yVZ37nnz64GNqZu/i18IRoPRGGfeYN/smKFhsKNtbw1JSWHk6VPTbN jlJLOXvQ9149zFlmJJHCxKiQ3FHvghgfgoi9W5J0Lg4Q+lqIriU= =POu3 -----END PGP SIGNATURE----- -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ### Device Details Discovered By: Andrew Klaus (andrew@aklaus.ca) Vendor: Actiontec (Telus Branded) Model: WEB6000Q Affected Firmware: 1.1.02.22 Reported: July 2018 CVE: CVE-2018-15557 ### Summary of Findings Two instances of Linux run on the WEB6000Q. One is the “main” instance that runs the web management server, TR-069 daemon, etc., while the other is the "quantenna" management OS used to manage the wireless. By hardcoding an IP address in the 169.254.1.0/24 network, and being on the same layer 2 network, root telnet access can be obtained on the "quantenna" management environment by accessing: Host: 169.254.1.2 Port: 23 Login: root (no password prompted) -----BEGIN PGP SIGNATURE----- iQIzBAEBCAAdFiEE/rRUDraOzqmrp8tZoyRid8jQfpkFAlz9T9cACgkQoyRid8jQ fpmyiw/+IOKANwITYMPOlXmvq4cY2ma8n5ckyeaLs2sEMTUM4OLg9Fnv7bqHxRs9 ++/sU7QPPjtMVhGIoehWqJgQp96zIV/x/JDxNlVvHn2IbYtOgSQOJ0uCxDvU7Tf5 khAmBtUSHMDq5qBlmPZxOUHnEEDjdx38OBt11Z9/yrSso5eJaXVsYs2SsEuLCzOq xH0VXi278VSx0mDVsAPT6GvAyYja+S23M49dhW48knQ9yBCt17Lhe1C04vcUNme0 GZQUUHKLBJl03mUgt91/pcRfqN+MlUMyyQiyi7w1fPQpTWONIArUM26XV+P9oLNu T08sh1vaAdaXim1AHpSURXX24TEsIYLW0Tb9SQVPMl1UZDcNq0ub9AdoAUuuXBWv nQ3jTCKlosH3GsIau1S3hlI8hoDF3li5e+bwt62JcqhI13pY1ZdcqZ+DHcbSGLN1 PW/CjPJxw05vamYzyZSgqS/FUlflzhboFp2s2/7XG8lBvt+pTQql5aYcxdcaZ1Sq TAGEXC3Kdb4BEQlqWuJNAlZWxeN6fhewb8IPDEJhdUZr2rGF9/1rmd3FlbwC6K2u 10o0lGrXVZ3hDnewwrBFNjLgvUj/nUtVlElkk1x/rsQnqDtnuKC4sS6xq9VO27Yo tW4gSB5LSjUcMVJyc0YbLjtYtd0mYem7l0dHjpnuqXst94GrHlk= =KDej -----END PGP SIGNATURE-----

Trust: 3.51

sources: NVD: CVE-2018-15555 // JVNDB: JVNDB-2018-015802 // CNVD: CNVD-2019-39178 // CNVD: CNVD-2019-39179 // CNVD: CNVD-2019-39177 // VULHUB: VHN-125826 // VULMON: CVE-2018-15555 // PACKETSTORM: 153262

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 1.8

sources: CNVD: CNVD-2019-39178 // CNVD: CNVD-2019-39179 // CNVD: CNVD-2019-39177

AFFECTED PRODUCTS

vendor:actiontecmodel:web6000qscope:eqversion:1.1.02.22

Trust: 3.6

sources: CNVD: CNVD-2019-39178 // CNVD: CNVD-2019-39179 // CNVD: CNVD-2019-39177 // JVNDB: JVNDB-2018-015802 // NVD: CVE-2018-15555

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2018-15555
value: CRITICAL

Trust: 1.0

NVD: CVE-2018-15555
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2019-39178
value: HIGH

Trust: 0.6

CNVD: CNVD-2019-39179
value: HIGH

Trust: 0.6

CNVD: CNVD-2019-39177
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201906-1094
value: CRITICAL

Trust: 0.6

VULHUB: VHN-125826
value: HIGH

Trust: 0.1

VULMON: CVE-2018-15555
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2018-15555
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2019-39178
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2019-39179
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2019-39177
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-125826
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2018-15555
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2019-39178 // CNVD: CNVD-2019-39179 // CNVD: CNVD-2019-39177 // VULHUB: VHN-125826 // VULMON: CVE-2018-15555 // JVNDB: JVNDB-2018-015802 // CNNVD: CNNVD-201906-1094 // NVD: CVE-2018-15555

PROBLEMTYPE DATA

problemtype:CWE-662

Trust: 1.1

problemtype:CWE-264

Trust: 0.9

sources: VULHUB: VHN-125826 // JVNDB: JVNDB-2018-015802 // NVD: CVE-2018-15555

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201906-1094

TYPE

permissions and access control issues

Trust: 0.6

sources: CNNVD: CNNVD-201906-1094

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2018-015802

PATCH
title:WEB6000Qurl:https://www.actiontec.com/products/home-networking/web6000q/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2018-015802

EXTERNAL IDS
db:PACKETSTORMid:153262
Trust: 4.5
db:NVDid:CVE-2018-15555
Trust: 4.5
db:JVNDBid:JVNDB-2018-015802
Trust: 0.8
db:CNNVDid:CNNVD-201906-1094
Trust: 0.7
db:CNVDid:CNVD-2019-39178
Trust: 0.6
db:CNVDid:CNVD-2019-39179
Trust: 0.6
db:CNVDid:CNVD-2019-39177
Trust: 0.6
db:VULHUBid:VHN-125826
Trust: 0.1
db:VULMONid:CVE-2018-15555
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-39178 // 
            
            
            
            CNVD: CNVD-2019-39179 // 
            
            
            
            CNVD: CNVD-2019-39177 // 
            
            
            
            VULHUB: VHN-125826 // 
            
            
            
            VULMON: CVE-2018-15555 // 
            
            
            
            JVNDB: JVNDB-2018-015802 // 
            
            
            
            PACKETSTORM: 153262 // 
            
            
            
            CNNVD: CNNVD-201906-1094 // 
            
            
            
            NVD: CVE-2018-15555

REFERENCES
url:http://packetstormsecurity.com/files/153262/telus-actiontec-web6000q-privilege-escalation.html
Trust: 5.1
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2018-15555
Trust: 2.6
url:http://seclists.org/fulldisclosure/2019/jun/1
Trust: 1.8
url:https://nvd.nist.gov/vuln/detail/cve-2018-15555
Trust: 1.5
url:https://cwe.mitre.org/data/definitions/662.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-15556
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2018-15557
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2019-39178 // 
            
            
            
            CNVD: CNVD-2019-39179 // 
            
            
            
            CNVD: CNVD-2019-39177 // 
            
            
            
            VULHUB: VHN-125826 // 
            
            
            
            VULMON: CVE-2018-15555 // 
            
            
            
            JVNDB: JVNDB-2018-015802 // 
            
            
            
            PACKETSTORM: 153262 // 
            
            
            
            CNNVD: CNNVD-201906-1094 // 
            
            
            
            NVD: CVE-2018-15555

CREDITS
Andrew Klaus
Trust: 0.1
sources:
            
            
            PACKETSTORM: 153262

SOURCES
db:CNVDid:CNVD-2019-39178
db:CNVDid:CNVD-2019-39179
db:CNVDid:CNVD-2019-39177
db:VULHUBid:VHN-125826
db:VULMONid:CVE-2018-15555
db:JVNDBid:JVNDB-2018-015802
db:PACKETSTORMid:153262
db:CNNVDid:CNNVD-201906-1094
db:NVDid:CVE-2018-15555

LAST UPDATE DATE
2024-11-23T22:11:59.078000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2019-39178date:2019-11-05T00:00:00
db:CNVDid:CNVD-2019-39179date:2019-11-05T00:00:00
db:CNVDid:CNVD-2019-39177date:2019-11-05T00:00:00
db:VULHUBid:VHN-125826date:2020-08-24T00:00:00
db:VULMONid:CVE-2018-15555date:2020-08-24T00:00:00
db:JVNDBid:JVNDB-2018-015802date:2019-07-08T00:00:00
db:CNNVDid:CNNVD-201906-1094date:2020-08-25T00:00:00
db:NVDid:CVE-2018-15555date:2024-11-21T03:51:03.247

SOURCES RELEASE DATE
db:CNVDid:CNVD-2019-39178date:2019-11-05T00:00:00
db:CNVDid:CNVD-2019-39179date:2019-11-05T00:00:00
db:CNVDid:CNVD-2019-39177date:2019-11-05T00:00:00
db:VULHUBid:VHN-125826date:2019-06-28T00:00:00
db:VULMONid:CVE-2018-15555date:2019-06-28T00:00:00
db:JVNDBid:JVNDB-2018-015802date:2019-07-08T00:00:00
db:PACKETSTORMid:153262date:2019-06-12T18:39:04
db:CNNVDid:CNNVD-201906-1094date:2019-06-28T00:00:00
db:NVDid:CVE-2018-15555date:2019-06-28T15:15:09.937