April 7, 2017 Karn Ganeshen

[ICS] Cambium ePMP SNMP Security Vulnerabilities

Cambium ePMP SNMP Security Vulnerabilities

Earlier in 2015, I reported multiple vulnerabilities in Cambium ePMP devices. The vendor finally fixed these and released new version(s). Here’s the first report detailing the issues and poc.

Cambium ePMP 1000 – Multiple vulnerabilities

Then late last year in 2016, I decided to take a look at SNMP implementation in Cambium ePMP appliances. After a few hours of checking out supported OIDs and corresponding device operations, the security issues stood out glaringly. The vendor, to the most part, attributed these (read: pass the ball) to SNMP v1/2c, which is inherently insecure; and IMO, still haven’t actually fixed the core issues. Why is this significant? Because, simply put, anyone can easily exploit these flaws to take over ePMP devices, and gather sensitive information.

AFFECTED PRODUCTS


IMPACT

These vulnerabilities may allow an attacker to access device configuration as well as make unauthorized changes to the device configuration.

Disclosure Timelines

 

BACKGROUND

Through its extensive portfolio of reliable, scalable and secure wireless narrowband and wireless broadband networks, Cambium Networks makes it possible for all service providers; industrial, enterprise, government, and service providers to build affordable, reliable, high-performance connectivity. Our wireless networks enable industrial Internet of things (IIoT) connectivity, and for service providers to improve customer satisfaction and efficiency.

SNMP Feature

SNMP is a standard protocol employed by many types of Internet protocol based products and allows centralized and remote device management capabilities. One of the many standard SNMP capabilities enables users to manage the product, including accessing device configuration, making changes, as well as triggering back up and restore.

Specific to Cambium devices:

  • It is possible to access full device configuration using SNMP. Device configuration includes usernames, passwords, SSIDs, keys, certificates, syslog config, and other network & wifi specific details.
  • It is possible to trigger configuration backups, which can then be retrieved using SNMP.
  • It is possible to wipe out and / or make changes to the device configuration remotely.


VULNERABILITY DETAILS

SNMP COMMUNITY STRINGS PRIVILEGES ARE NOT ENFORCED CORRECTLY

It is possible to use SNMP ReadOnly community string to access MIBs that should only be accessible using ReadWrite community string (for example Wireless key). Different versions leak different pieces of RW-only accessible information. Current version (at the time of reporting 3.2) allowed RO string to read WPA2 key.

For example:


DEVICE CONFIGURATION BACKUPS – ACCESS CONTROL ISSUES

Using SNMP, device configuration backups can be remotely triggered. Using specific MIBs, we can:

  1. trigger the backup, and
  2. identify exact backup file name, & location.

In case any backup file(s) are already present, their names & locations can also be retrieved.

All the backup files are uploaded on the web server root directory /, and lack any access control. Anyone can enumerate & dump the backup configuration file(s) directly. Using the information in device configuration, it may be possible to gain access to the device, and / or its clients (wireless devices and users).

+++++

I will be releasing Metasploit module for this vulnerability shortly.

Cheers!

Tagged: , , , , , ,

Leave a Reply

Your email address will not be published. Required fields are marked *