Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Summary
Title Hughes satellite modems contain multiple vulnerabilities
Informations
Name VU#614751 First vendor Publication 2017-02-15
Vendor VU-CERT Last vendor Modification 2017-02-15
Severity (Vendor) N/A Revision M

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:A/AC:L/Au:N/C:C/I:C/A:C)
Cvss Base Score 8.3 Attack Range Adjacent network
Cvss Impact Score 10 Attack Complexity Low
Cvss Expoit Score 6.5 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Vulnerability Note VU#614751

Hughes satellite modems contain multiple vulnerabilities

Original Release date: 15 Feb 2017 | Last revised: 15 Feb 2017

Overview

Several models of Hughes high-performance broadband satellite modems are potentially vulnerable to several issues if not appropriately configured.

Description

Several models of Hughes high-performance broadband satellite modems are potentially vulnerable to the following issues if not appropriately configured:

CWE-20: Improper Input Validation - CVE-2016-9494

The device's advanced status web page that is linked to from the basic status web page does not appear to properly parse malformed GET requests. This may lead to a denial of service.

CWE-798: Use of Hard-coded Credentials - CVE-2016-9495

Access to the device's default telnet port (23) using one of a few default credentials shared among all devices.

CWE-306: Missing Authentication for Critical Function - CVE-2016-9496

An unauthenticated user may send an HTTP GET request to http://[ip]/com/gatewayreset or http://[ip]/cgi/reboot.bin to cause the modem to reboot.

CWE-288: Authentication Bypass Using an Alternate Path or Channel - CVE-2016-9497

By default, port 1953 is accessible via telnet and does not require authentication. An unauthenticated remote user can access many administrative commands via this interface, including rebooting the modem.

According to the reporter, the following models may be affected:

  • HN7740S
  • DW7000
  • HN7000S/SM

    Other models may also be affected.

  • Impact

    An unauthenticated remote attacker may be able to cause a denial of service via one of several methods, or can access some administrative commands via telnet.

    Solution

    Hughes has provided the following statement:


    "The Hughes system has the ability to configure the modem which will prevent access and exploitation of the listed potential vulnerabilities. Hughes has provided service providers with documentation on the parameters and current software versions required to address these potential vulnerabilities. Customers should contact their service provider to ensure the locked down configuration is pushed to their devices."

    Update the firmware

    DW7000, HN7740S, and HN7000S/SM devices running software versions prior to 6.9.0.34 are vulnerable. Devices running 6.9.0.34 or higher can be configured to prevent exploit of the listed potential vulnerabilities.

    Restrict network access

    Restrict network access to the Hughes modem and devices on its local network that use open protocols like HTTP.

    Vendor Information (Learn More)

    VendorStatusDate NotifiedDate Updated
    Hughes Network Systems, Inc.Affected16 Mar 201615 Feb 2017
    If you are a vendor and your product is affected, let us know.

    CVSS Metrics (Learn More)

    GroupScoreVector
    Base7.3AV:A/AC:L/Au:N/C:P/I:P/A:C
    Temporal6.2E:POC/RL:W/RC:C
    Environmental4.7CDP:ND/TD:M/CR:ND/IR:ND/AR:ND

    References

    • None

    Credit

    Thanks to the reporter who wishes to remain anonymous.

    This document was written by Garret Wassermann.

    Other Information

    • CVE IDs:CVE-2016-9494CVE-2016-9495CVE-2016-9496CVE-2016-9497
    • Date Public:15 Feb 2017
    • Date First Published:15 Feb 2017
    • Date Last Updated:15 Feb 2017
    • Document Revision:52

    Feedback

    If you have feedback, comments, or additional information about this vulnerability, please send us email.

    Original Source

    Url : http://www.kb.cert.org/vuls/id/614751

    CWE : Common Weakness Enumeration

    % Id Name
    25 % CWE-798 Use of Hard-coded Credentials (CWE/SANS Top 25)
    25 % CWE-306 Missing Authentication for Critical Function (CWE/SANS Top 25)
    25 % CWE-287 Improper Authentication
    25 % CWE-20 Improper Input Validation

    CPE : Common Platform Enumeration

    TypeDescriptionCount
    Os 1
    Os 1
    Os 1
    Os 1

    Alert History

    If you want to see full details history, please login or register.
    0
    1
    2
    3
    Date Informations
    2018-09-11 17:21:51
    • Multiple Updates
    2018-09-06 21:22:02
    • Multiple Updates
    2018-07-14 00:21:04
    • Multiple Updates
    2017-02-15 21:22:51
    • First insertion