CVE-2017-18373

Vulnerability

The Billion 5200W-T TCLinux Fw $7.3.8.0 v008 130603 router, distributed by TrueOnline, includes three default user accounts, two of which are hardcoded service accounts: one with username true and password true, and another with username user3 and a password consisting of a repetition of the string 0123456789. These accounts are present in the web interface and can be used for authentication [1][2].

Exploitation

An attacker with network access to the router's web interface can log in using either of the hardcoded credentials. Once authenticated, the attacker can exploit command injection vulnerabilities in the syslog remote forwarding function (e.g., via ViewLog.asp) by crafting POST requests with injected commands in the remote_host parameter, leading to arbitrary command execution as root [1][2].

Impact

Successful exploitation grants the attacker full control over the router, allowing them to modify settings, intercept network traffic, launch further attacks, and maintain persistent access. This compromises the confidentiality, integrity, and availability of the device and the network it serves [1][2].

Mitigation

No official firmware patch has been released to address these issues. Users should immediately change the passwords of all default accounts and disable unused service accounts if possible. For routers still in use, restrict remote access to trusted IPs and monitor for unauthorized activity [1][2].