Summary
A critical Remote Code Execution (RCE) vulnerability has been discovered on TCP port 6998. This vulnerability arises due to improper sanitation of user input in a CWMP (CPE WAN Management Protocol) service. Exploiting this flaw allows an attacker to execute arbitrary system commands with root privileges, leading to full system compromise.
Credit
An independent security researcher working with SSD Secure Disclosure.
Vendor Response
“Just following up on this as we have completed our analysis of our Gigacenter devices which are still actively supported, and I can confirm that those also do not have a locally accessible CWMP (TR-069) service running. As the only devices with this vulnerability present appear to be these EOL rebranded systems, we will be closing this issue out. We will create an advisory for our customers who are still deploying these unsupported CPEs to ensure they are aware of the security issue.”
Affected Versions
- 812Gv2, 813Gv2, and 813Gv2-2
- 5VT devices (developed by a third-party under Calix branding)
- Several rebranded devices – unfortunately we are not aware of any list of such rebranded devices that are affected
Technical Analysis
During a TCP and UDP port scan (range: 1-65535), it was observed that Gigacenter devices have TCP port 6998 open.
Upon connecting to this port, the following prompt appeared:
cwmp.0001>
Testing user input within this shell revealed that special characters, such as backticks () and command substitution $(), were not properly sanitized.
Input enclosed within these characters was executed as system commands.
Exploitation is very easy, just input any shell command you wish to run inside the ():
cwmp.0001> $(ping -c5 your.ip.address)
