Sensitive-Information-disclosure-via-SPI-flash-firmware-for-Hathway-router-CVE-2024-46383

Vulnerability Description:

During the security assessment of the Router firmware, it was observed that sensative information regarding the devices connected to router such as Mobile phone,Laptos, Tablets is stored in plain textand attacker can miuse it.

Vendor of the product: Hathway

Affected product:CM5100-511

Affected Version: 4.1.1.24

Vulnerability Score V3.1: 5.2 Medium AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:L/A:N

Proof Of Concept:

1. Power on the router and do the initial network reconnaissance using Nmap tool.

   

2. Teardown the router and locate the UART connection as shown in below Image. Connect the UART connection to serial console and check the initial boot sequence of router. Form initial boot sequence we got the hardware and firmware version information.

   

3. From Hardware PCB analysis it was observed that external flash IC(Winbond W25Q64JV) is connected back side, solder out the flash IC from PCB and using CH431A flash programmer dump the firmware.

   

4. After dumping the flash firmware,Perform the analysis of dumped binary file and we found that, names of mobile phones, laptops, Tablets which are coonected to router are stored in plain text.

   

Authors:

Nitin Ronge(www.linkedin.com/in/nitin-ronge)

Anand Yadav(www.linkedin.com/in/anandyadav6962)