Remote code execution in Sagemcom F@st Cable Modems

1) Buffer overflow

EUVDB-ID: #VU24232

Risk: High

CVSSv3.1: 8.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C]

CVE-ID: CVE-2019-19494

CWE-ID: CWE-119 - Memory corruption

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing packets sent to spectrum analyzer build-in feature. By default the affected router accepts requests from local network only, however an attacker can craft a specially crafted webpage and use victim's browser to deliver malicious request to the affected router, e.g. via websockets and a specially crafted JSON payload.

Successful exploitation of this vulnerability may result in complete compromise of the affected router.

Note, this vulnerability was dubbed Cable Haunt by the researcher.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

F@st 3890: before 50.10.21_T4

F@st 3686: before 4.83.0

External links

http://cablehaunt.com
http://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf
http://github.com/Lyrebirds/Fast8690-exploit
http://www.broadcom.com

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

How the attacker can exploit this vulnerability?

The attacker would have to send a specially crafted request to the affected device in order to exploit this vulnerability.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.