Quantum Secular Labs / Blog / Advisories
CVE-2017-20204: DBLTek GoIP devices (models GoIP 1, 4, 8, 16, and 32) contain an undocumented vendor backdoor in the Telnet…
CVE-2017-20204 is rated critical with a CVSS v4.0 base score of 9.3. Per its scoring, it can be exploited over the network, without authentication, without any user interaction. The scored impact on confidentiality, integrity and availability is the highest available.
Vulnerability description
DBLTek GoIP devices (models GoIP 1, 4, 8, 16, and 32) contain an undocumented vendor backdoor in the Telnet administrative interface that allows remote authentication as an undocumented user via a proprietary challenge–response scheme which is fundamentally flawed. Because the challenge response can be computed from the challenge itself, a remote attacker can authenticate without knowledge of a secret and obtain a root shell on the device. This can lead to persistent remote code execution, full device compromise, and arbitrary control of the device and any managed services. The firmware used within these devices was updated in December 2016 to make this vulnerability more complex to exploit. However, it is unknown if DBLTek has taken steps to fully mitigate.
Severity breakdown
CVSS v4.0 9.3: CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
- Attack vector: Network. Exploitable remotely over the network.
- Attack complexity: Low. No special conditions; the attack can be repeated reliably.
- Attack requirements: None. No deployment or execution conditions are needed.
- Privileges required: None. No account or prior access is needed.
- User interaction: None. No action from any user is needed.
- Confidentiality impact (vulnerable system): High. Total loss of confidentiality.
- Integrity impact (vulnerable system): High. Total loss of integrity.
- Availability impact (vulnerable system): High. Total loss of availability.
- Confidentiality impact (subsequent systems): None. No confidentiality impact beyond the vulnerable system.
- Integrity impact (subsequent systems): None. No integrity impact beyond the vulnerable system.
- Availability impact (subsequent systems): None. No availability impact beyond the vulnerable system.
Underlying weakness
CWE-1242: Inclusion of Undocumented Features or Chicken Bits
The device includes chicken bits or undocumented features that can create entry points for unauthorized actors.