Security advisory - CVE-2019-9229

Remote Access to internal quagga interface with hard coded credentials in AudioCodes Mediant family

Affected Products

• AudioCodes Mediant 500L-MSBR
• AudioCodes Mediant 500-MBSR
• AudioCodes Mediant M800B-MSBR
• AudioCodes Mediant 800C-MSBR

Background

AudioCodes Mediant family of multi-service business routers (MSBRs) offers service providers a range of all-in-one SOHO, SMB and SME routers combining access, data, voice and security into a single device.[1]
During our research we found a DoS(CVE-2019-9228), a XXS(CVE-2019-9230) and CSRF(CVE-2019-9231) vulnerability. Although we could gain access to quagga VTYs(CVE-2019-9229).

References

• https://www.cirosec.de/fileadmin/1._Unternehmen/1.4._Unsere_Kompetenzen/Security_Advisory_AudioCodes_Mediant_family.pdf
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-9229

Description

An internal interface exposed to the link-local address 169.254.254.253 allows attackers in the local network to access multiple quagga VTYs. Attackers can authenticate with the default password "1234" that cannot be changed, and can execute malicious and unauthorized actions.

Affected Versions

F7.20A to F7.20A.251

Mitigation

Update to F7.20A.252 or higher.

Disclosure Timeline

2019/02/14	vendor contacted
2019/02/14	initial vendor response
2019/02/14	vendor informs about start of review process
2019/02/15	vendor requests further details
2019/02/15	further details provided
2019/02/18	vendor informs about detail analysis
2019/02/19	vendor confirmation, planned fixes and roadmap provided
2019/03/01	CVEs assigned
2019/06/28	vendor informs that planned fixes are published

Credits