Auerswald COMpact 5500R 7.8A and 8.0B Devices Backdoor

criticalseverity

9.8CVSS score

72%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Auerswald COMpact 5500R 7.8A and 8.0B devices contain an unauthenticated endpoint ("https://192.168.1[.]2/about_state"), enabling the bad actor to gain backdoor access to a web interface that allows for resetting the administrator password.

Impact

Unauthenticated attackers can gain unauthorized access to affected devices.

Fix

Apply the latest firmware update provided by Auerswald to fix the backdoor vulnerability.

How to confirm it

Send: GET {{BaseURL}}/about_state
Positive when: contains "\"pbx\"" and "\"dongleStatus\":0" and "\"macaddr\"" AND contains in header "application/json" AND status 200

Run it with nuclei: nuclei -id CVE-2021-40859 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-40859

info:
  name: Auerswald COMpact 5500R 7.8A and 8.0B Devices Backdoor
  author: pussycat0x
  severity: critical
  description: Auerswald COMpact 5500R 7.8A and 8.0B devices contain an unauthenticated endpoint ("https://192.168.1[.]2/about_state"), enabling the bad actor to gain backdoor access to a web interface that allows for resetting the administrator password.
  impact: |
    Unauthenticated attackers can gain unauthorized access to affected devices.
  remediation: |
    Apply the latest firmware update provided by Auerswald to fix the backdoor vulnerability.
  reference:
    - https://thehackernews.com/2021/12/secret-backdoors-found-in-german-made.html
    - https://nvd.nist.gov/vuln/detail/CVE-2021-40859
    - https://www.redteam-pentesting.de/en/advisories/-advisories-publicised-vulnerability-analyses
    - https://www.redteam-pentesting.de/en/advisories/rt-sa-2021-007/-auerswald-compact-multiple-backdoors
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-40859
    epss-score: 0.71979
    epss-percentile: 0.99433
    cpe: cpe:2.3:o:auerswald:compact_5500r_firmware:7.8a:build002:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: auerswald
    product: compact_5500r_firmware
    fofa-query: '"auerswald"'
  tags: cve2021,cve,iot,unauth,voip,auerswald,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/about_state"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - '"pbx"'
          - '"dongleStatus":0'
          - '"macaddr"'
        condition: and

      - type: word
        part: header
        words:
          - "application/json"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from