<p>Tenable Research discovered multiple vulnerabilities in Verizon’s Fios Quantum Gateway routers.</p>
<h2>Background</h2>
<p>Tenable Research has discovered multiple vulnerabilities in the <a href="https://www.verizon.com/home/accessories/fios-quantum-gateway/" target="_blank" rel="noopener noreferrer" title="Tenable Research discovered multiple vulnerabilities in Verizon Fios Quantum Gateway">Verizon Fios Quantum Gateway</a> (G1100) router. Verizon has released firmware version 02.02.00.13 to fix these vulnerabilities.</p>
<h2>Analysis</h2>
<p>There is a sticker on the side of the routers. Each customer is given a different Wireless network name, Wireless password, and Administrator password. These vulnerabilities are focused around the Administrator password, not the password you use to connect to the Wi-Fi. The Administrator password is there for the Verizon customer to log into the router to perform various tasks that define the network. The vulnerabilities include:</p>
<h3>CVE-2019-3914 - Authenticated Remote Command Injection</h3>
<p>This vulnerability can be triggered by adding a firewall access control rule for a network object with a crafted hostname. An attacker must be authenticated to the device's administrative web application in order to perform the command injection. In most cases, the vulnerability can only be exploited by attackers with local network access. However, an internet-based attack is feasible if remote administration is enabled; it is disabled by default.</p>
<h3>CVE-2019-3915 - Login Replay</h3>
<p>Because HTTPS is not enforced in the web administration interface, an attacker on the local network segment can intercept login requests using a packet sniffer. These requests can be replayed to give the attacker admin access to the web interface. From here, the attacker could exploit CVE-2019-3914.</p>
<h3>CVE-2019-3916 - Password Salt Disclosure</h3>
<p>An unauthenticated attacker is able to retrieve the value of the password salt by simply visiting a URL in a web browser. Given that the firmware does not enforce the use of HTTPS, it is feasible for an attacker to capture (sniff) a login request. The login request contains a salted password hash (SHA-512), so the attacker could then perform an offline dictionary attack to recover the original password.</p>
<h2>Impact</h2>
<p>These routers are supplied to all new Verizon Fios customers unless they elect to use their own router, which isn’t very common. Tenable researcher <a href="https://twitter.com/lynerc" target="_blank" rel="noopener noreferrer" title="Tenable Researcher Chris Lyne on Twitter">Chris Lyne</a> has outlined several potential attack scenarios for these vulnerabilities.</p>
<h4>Scenario 1: Rebellious teen (insider threat)</h4>
<p><i>CVE-2019-3915 - Login Replay</i></p>
<p>Let's assume the Verizon customer is a parent of a teenager. The teenager wants to circumvent parental controls, as teens are wont to do. Let's assume the parent is smart and has changed the Administrator password for the router. The teen can’t just use the credentials on the sticker to log into the administrative interface and change the parental controls. They have to try something else.</p>
<p>It's safe to say that a concerned parent would log into the router from time to time to check whether the teen has tried to flout the parental controls. Because HTTPS is not enforced in the web browser, a clever teen could perform packet sniffing and record the parent’s login. After recording the login sequence, the teen could then replay the login to gain access to the router's administrative interface (CVE-2019-3915). At this point, he or she could change the parental controls, delete evidence of misbehavior, etc.</p>
<h4>Scenario 2: The house guest who never left (insider threat, remote attack)</h4>
<p><i>CVE-2019-3914 - Authenticated Remote Command Injection</i></p>
<p>People have house guests over all the time - family members, friends, friends of friends, or maybe even AirBNB guests. Often, you'll give your guests your Wi-Fi password (WPA2 key) to allow them to use your internet connection.</p>
<p>So, the house guest is physically in your home and has connected to your Wi-Fi. The house guest can determine your public IP address by visiting <a href="https://www.whatismyip.com/" target="_blank" rel="noopener noreferrer" title="https://www.whatismyip.com/">https://www.whatismyip.com/</a> on their mobile device. They could also take a photo of the credential sticker on the Verizon Fios Quantum Gateway router.</p>
<p>Using this information, the house guest could do either of the following:</p>
<ol>
<li>Log into the router's administrative web interface to enable Remote Administration.</li>
<li>Hope that Remote Administration is already enabled. (A <a href="https://www.shodan.io/search?query=title%3A%22Verizon+Router%22&lang... target="_blank" rel="noopener noreferrer" title="Shodan.io search for Verizon Fios router vulnerabilities">Shodan.io search</a> shows 15,323 Verizon routers with Remote Administration enabled.)</li>
</ol>
<p>After the house guest leaves, he or she can exploit CVE-2019-3914 remotely, from across the internet, to gain remote root shell access to the router's underlying operating system. From here, the house guest has control of the network. The attacker can create back doors, record sensitive internet transactions, pivot to other devices, etc.</p>
<h4>Scenario 3: Verizon tech support social engineering (remote attack)</h4>
<p><i>CVE-2019-3914 - Authenticated Remote Command Injection</i></p>
<p>Social engineering attacks aren’t just about phishing campaigns and data breaches due to untrained employees. They happen against “average” consumers all the time, too. It is entirely possible that a malicious actor would perform social engineering by masquerading as a Verizon tech support employee.</p>
<p>In this scenario, the attacker, posing as a customer support employee, calls a Verizon customer (victim) and pretends there is some sort of an issue with their Verizon Fios service. The attacker asks the customer for his/her Administrator password on the side of the router and to log into the router's admin web interface. At this point, the attacker could ask for the Public IP address which is conveniently displayed immediately after logging in. Also, the attacker would ask the victim to enable Remote Administration.</p>
<p>With this information, the attacker can exploit CVE-2019-3914 remotely, with the same outcome as Scenario 2.</p>
<h2>Solution</h2>
<p>Users are urged to confirm that their router is updated to version 02.02.00.13, and if not, contact Verizon for more information. It is recommended that users keep remote administration disabled.</p>
<h2>Additional information</h2>
<ul>
<li>Visit the <a href="https://medium.com/tenable-techblog/verizon-fios-router-authenticated-co... target="_blank" rel="noopener noreferrer" title="Tenable Tech Blog on Medium">Tenable Tech Blog on Medium</a> to read researcher <a href="https://twitter.com/lynerc" target="_blank" rel="noopener noreferrer" title="Tenable Researcher Chris Lyne on Twitter">Chris Lyne</a>’s in-depth story about his work uncovering these vulnerabilities</li>
<li><a href="https://www.tenable.com/security/research/tra-2019-17" target="_blank" rel="noopener noreferrer" title="Tenable Advisory">Tenable Advisory</a></li>
</ul>
<p><b><i>Learn more about <a href="https://www.tenable.com/products">Tenable</a>, the first Cyber Exposure platform for holistic management of your modern attack surface. Get a <a href="https://www.tenable.com/products/tenable-io/vulnerability-management/eva... 60-day trial</a> of Tenable.io Vulnerability Management. </i></b></p>