Cable Haunt – Critical Vulnerability Let Hackers Control Cable Modems Remotely
Researchers discovered as critical vulnerability dubbed Cable Haunt affects cable modems from different manufacturers across the globe.
The vulnerability enables a remote attacker to gain complete control over the modem through its endpoint.
Successful exploitation allows attackers to intercept private messages, redirect traffic, or participate in botnets.
Cable Haunt vulnerability was discovered by a team of Danish security researchers in Broadcom cable modems.
Cable Haunt Attacks Middleware
The vulnerability targets the middleware running on the chip used in the Broadcom cable modems, the middleware is the real-time operating system in cable modems that runs all the networking tasks.
It affects multiple vendors as the same software being used by various cable modem manufacturers to create their cable modem firmware.
All the traffic goes through the cable modem middleware (CM), by gaining control over it attackers can manipulate any traffic going through the modem.
How the Attack Works
The attack is a two-step process: An attacker should gain access to the vulnerable endpoints through local networks such as browsers, this can be done by making the victim opening a malicious link in a browser.
The exploit not only the browser, but it can also be executed in any place where running the code can reach IP on the local network.
Next, the attacker needs to hit the vulnerable endpoint with buffer overflow attack, by creating a crafted message a remote attacker can manipulate the modem to execute arbitrary code specified by a remote attacker.
Once the code executed attackers can gain complete control over the modem and can perform various operation such as
- Change default DNS server
- Conduct remote man-in-the-middle attacks
- Hot-swap code or even the entire firmware
- Upload, flash, and upgrade firmware silently
- Disable ISP firmware upgrade
- Change every config file and settings
- Get and Set SNMP OID values
- Change all associated MAC Addresses
- Change serial numbers
- Be exploited in botnet
Modems Affected
Researchers estimated that “more than 200 million modems may be or might have been vulnerable in Europe alone and there is no way to track the vulnerability spread”.
Here is the list of vulnerable modems:
| Model | Firmware Version | Port | Default Credentials |
|---|---|---|---|
| Sagemcom 3890 | 50.10.19.* | 6080 | spectrum:spectrum (Authorization: Basic) |
| Sagemcom 3686 | SIP_3.428.0-* | 6080 | spectrum:spectrum (Authorization: Basic) |
| Technicolor TC7230 | STEB 01.25 | 8080 | No authorization needed |
| Netgear C6250EMR | V2.01.05 | 8080 | No authorization needed |
| Netgear CG3700EMR | V2.01.03 | 8080 | No authorization needed |
| Sagemcom 3890 | 05.76.6.3a | unknown | unknown |
| Sagemcom 3686 | 4.83.0 | unknown | unknown |
| COMPAL 7284E | 5.510.5.11 | unknown | unknown |
| COMPAL 7486E | 5.510.5.11 | unknown | unknown |
| Netgear CG3700EMR | V2.01.05 | 8080 | No authorization needed |
As the cable Haunt allows attackers to gain complete access to the modem it is hard to detect the infection as the attacker can hide the tracks.
Researchers also stated that there is no evidence of active exploitation, and this attack doesn’t break SSL/TLS encryption.
A tool has been released to check whether your modem is vulnerable, the tool can be downloaded from here.
Here you find the detailed Technical report explaining the Cable Haunt vulnerability and the PoC of the attack.
This post Cable Haunt – Critical Vulnerability Let Hackers Control Cable Modems Remotely originally appeared on GB Hackers.
