Threat Signal Report

Path Traversal Vulnerability in Arcadyan Firmware Putting Millions of IoT Devices at Risk

Description

FortiGuard Labs is aware of a report that a path traversal vulnerability (CVE-2021-20090) in Arcadyan firmware used in routers leads to an authentication bypass. Successfully exploiting the vulnerability allows the attacker to bypass authentication to access restricted pages and perform any action on the device without authentication. According to security vendor Tenable, the vulnerability in Arcadyan's firmware, "has existed for at least 10 years and has therefore found its way through the supply chain into at least 20 models across 17 different vendors." There also is a report that the vulnerability is being exploited in the wild in order to deploy Mirai malware.

When was the Vulnerability Disclosed?

The vulnerability was disclosed by security vendor Tenable on August 3rd, 2021.

How Serious of an Issue is This?

HIGH. According to Tenable, the vulnerability has existed for at least 10 years and has therefore found its way through the supply chain into at least 20 models across 17 different vendors". Also security vendor Juniper reported that the vulnerability is being exploited in the wild in order to deploy Mirai malware.

Many routers do not receive periodic security updates from their manufacturers and when they do they most often need to be applied manually.

What is the Vulnerability Exploited in this Attack in Order to Deliver Mirai malware?

The exploited vulnerability is a path traversal vulnerability (CVE-2021-20090), which allows unauthenticated users to access restricted pages and take control of the affected device. The vulnerability is in Arcadyan's router firmware that is used by various router manufactures.

Which Routers are Affected?

Tenable provided the following list of affected routers. Note that as Tenable stated the vulnerability has existed more than 10 years, there may be other affected routers.

http://www.w3.org/1999/xhtml" dir="ltr" style="font-size: 10pt; line-height: 1.1; margin: 1em 0px; padding: 0px; width: 813px; color: rgb(119, 119, 121); table-layout: fixed; font-family: Arial; border: none;" height="878" cellspacing="0" cellpadding="0" border="1">

`Vendor`	`Device`	`Found on version`
`ADB`	`ADSL wireless IAD router`	`1.26S-R-3P`
`Arcadyan`	`ARV7519`	`00.96.00.96.617ES`
`Arcadyan`	`VRV9517`	`6.00.17 build04`
`Arcadyan`	`VGV7519`	`3.01.116`
`Arcadyan`	`VRV9518`	`1.01.00 build44`
`ASMAX`	`BBR-4MG / SMC7908 ADSL`	`0.08`
`ASUS`	`DSL-AC88U (Arc VRV9517)`	`1.10.05 build502`
`ASUS`	`DSL-AC87VG (Arc VRV9510)`	`1.05.18 build305`
`ASUS`	`DSL-AC3100`	`1.10.05 build503`
`ASUS`	`DSL-AC68VG`	`5.00.08 build272`
`Beeline`	`Smart Box Flash`	`1.00.13_beta4`
`British Telecom`	`WE410443-SA`	`1.02.12 build02`
`Buffalo`	`WSR-2533DHPL2`	`1.02`
`Buffalo`	`WSR-2533DHP3`	`1.24`
`Buffalo`	`BBR-4HG`
`Buffalo`	`BBR-4MG`	`2.08 Release 0002`
`Buffalo`	`WSR-3200AX4S`	`1.1`
`Buffalo`	`WSR-1166DHP2`	`1.15`
`Buffalo`	`WXR-5700AX7S`	`1.11`
`Deutsche Telekom`	`Speedport Smart 3`	`010137.4.8.001.0`
`HughesNet`	`HT2000W`	`0.10.10`
`KPN`	`ExperiaBox V10A (Arcadyan VRV9517)`	`5.00.48 build453`
`KPN`	`VGV7519`	`3.01.116`
`O2`	`HomeBox 6441`	`1.01.36`
`Orange`	`LiveBox Fibra (PRV3399)`	`00.96.00.96.617ES`
`Skinny`	`Smart Modem (Arcadyan VRV9517)`	`6.00.16 build01`
`SparkNZ`	`Smart Modem (Arcadyan VRV9517)`	`6.00.17 build04`
`Telecom (Argentina)`	`Arcadyan VRV9518VAC23-A-OS-AM`	`1.01.00 build44`
`TelMex`	`PRV33AC`	`1.31.005.0012`
`TelMex`	`VRV7006`
`Telstra`	`Smart Modem Gen 2 (LH1000)`	`0.13.01r`
`Telus`	`WiFi Hub (PRV65B444A-S-TS)`	`v3.00.20`
`Telus`	`NH20A`	`1.00.10debug build06`
`Verizon`	`Fios G3100`	2.0.0.6
`Vodafone`	`EasyBox 904`	`4.16`
`Vodafone`	`EasyBox 903`	`30.05.714`
`Vodafone`	`EasyBox 802`	`20.02.226`

What is Mirai Malware?

Mirai is a Linux malware that targets IoT devices to form a Mirai botnet which is typically used for large-scale DDoS attacks. Mirai's source code was made available in 2016 by a Hackforums user "Anna-senpai", named after a female character in Japanese novel "Shimoneta: A Boring World Where the Concept of Dirty Jokes Doesn't Exist", which prompted other attackers to develop and release subsequent variants.

FortiGuard Labs recently published a blog on Mirai malware and its variants. Please see a link to "The Ghosts of Mirai" in the Appendix.

Is the Patch Available for CVE-2021-20090?

Unconfirmed as the vulnerability needs to be fixed by each router manufactures.

What is the Status of Coverage?

Customers running the latest IPS definitions are protected by the following signature:

Arcadyan.Routers.images.Path.Authentication.Bypass

FortiGuard Labs provides the following AV coverage for the associated Miral malware, some of which are not directly related to the attack but came from the same IP involved in the CVE-2021-20090 attack:

ELF/Mirai.AE!tr

ELF/Mirai.ASX!tr

ELF/Mirai.BL!tr

ELF/Mirai.BO!tr

ELF/Mirai.GG!tr

ELF/Mirai.IA!tr

ELF/Mirai.VI!tr

ELF/DDoS.CIA!tr

BAT/Agent.1763!tr.dldr

BAT/Agent.4406!tr.dldr

ELF/Gafgyt.LT!tr

All known network IOC's are blocked by the FortiGuard WebFiltering client.

Any Other Suggested Mitigation?

As a mitigation, FortiGuard Labs recommends to disable the remote (WAN-side) administration services on the affected router and disable the web interface on the WAN.