Critical flaws patched in ISP Advanced Digital Broadcast Broadband devices

11.7.18 securityaffairs Vulnerebility

Advanced Digital Broadcast has rolled out security patched to fix three critical vulnerabilities in Its Broadband gear.
Advanced Digital Broadcast has released patches for three critical vulnerabilities affecting broadband gateways. All the ADB Broadband Gateways and Routers based on Epicentro platform are affected by the vulnerabilities.

The flaws were discovered nearly two years ago, they are a privilege escalation bug, an authorization bypass issue, and a local jailbreak bug.

The Advanced Digital Broadcast manufactures routers and network devices dozens of broadband and telco firms.

The vulnerabilities were first discovered in June 2016 by experts at SEC Consult Vulnerability Lab.

The company started rolling out the patches in July 2017.

Let’s see in detail the three flaws:

The CVE-18-13108 flaw is a local root jailbreak flaw that can be exploited leveraging a network file sharing vulnerability.
“By exploiting the local root vulnerability on affected and unpatched devices an attacker is able to gain full access to the device with highest privileges,” according to researchers. “Attackers are able to modify any settings that might have otherwise been prohibited by the ISP. It is possible to retrieve all stored user credentials (such as VoIP) or SSL private keys.”

Experts explained that the “network file sharing” feature of ADB broadband devices via USB leverages a Samba daemon to access be USB devices. The access has the highest access rights and exports the network shares with root user permissions. Attackers can abuse the Samba daemon that runs in the background to access the USB port.

The CVE-18-13109 authorization bypass vulnerability that affects some versions of firmware used in ADB broadband devices. The flaw could be exploited by an attacker to gain access to the device settings within the web interface otherwise forbidden to the user.
“By exploiting the authorization bypass vulnerability on affected and unpatched devices an attacker is able to gain access to settings that are otherwise forbidden for the user, e.g. through strict settings set by the ISP.” researchers wrote. “It is also possible to manipulate settings to e.g. enable the telnet server for remote access if it had been previously disabled by the ISP.”

The CVE-18-13110 privilege escalation vulnerability via Linux group manipulation that could be exploited by an attacker to gain access to the command line interface (CLI) of the device, even if the CLI was previously disabled by the ISP.
“By exploiting the group manipulation vulnerability on affected and unpatched devices an attacker is able to gain access to the command line interface (CLI) if previously disabled by the ISP.” researchers wrote.

“Depending on the feature-set of the CLI (ISP dependent) it is then possible to gain access to the whole configuration and manipulate settings in the web GUI and escalate privileges to highest access rights.”

ADB has released an updated firmware that addresses the flaws.