Hackers are abusing a fault (CVE-2018-20377) in Orange Livebox ASDL modems that let them get the SSID and the Wi-Fi password of the appliances in plaintext. As soon as access is gained to a weak modem, attackers could update the firmware and alter device settings. Abusing the vulnerability is as easy as sending a GET request.
The vulnerability was identified by Troy Mursch at Bad Packets, who noted the company’s honeypots were being scanned with
Identifying the appliances is a swift and easy procedure. A search can be carried out on the search engine Shodan. A rapid search by Mursch demonstrated there are presently 19,490 of the vulnerable modems in use. Additional 2,018 modems were not leaking data but were exposed to the Internet.
As soon as identified, an attacker only requires to send a GET request to “/get_getnetworkconf.cgi to get plaintext SSIDs and WiFi passwords. An attacker can also see the phone number of the client and the MAC addresses and names of all related clients. Mursch also found that password reuse was widespread, and many appliances had not set a custom password, instead, they used the default admin/admin identifications.
The attack identified by Mursch seems to come from within Spain from a Telefonica Spain customer. It is presently unclear why attempts are being made to access the modems’ Wi-Fi identifications.
Mursch has reported the fault to CCN-CERT, Orange Espana, and Orange-CERT and the vulnerability is presently being probed. The