CVE-2021-27825

Executive Summary

CVE-2021-27825 is a directory traversal vulnerability affecting Mercury MAC1200R routers. The flaw allows unauthenticated remote attackers to read arbitrary files on the device by crafting a request to the /web-static/ endpoint. Despite being publicly disclosed with a working exploit, no official patch has been released by the vendor. The attack vector is trivial to execute, requiring only network access to the router’s web interface (typically on port 8888). This vulnerability poses a significant risk to exposed devices, enabling attackers to extract sensitive configuration files, credentials, or other system data.

Supply Chain & Package Security

This vulnerability does not involve NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in embedded router hardware.

CVSS Breakdown & Threat Level

The NVD CVSS score is 0.0, indicating incomplete or missing scoring. Based on the exploit characteristics, a reasonable CVSS v3.1 vector would be:

• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): None (N)
• Availability (A): None (N)

Estimated CVSS Score: 7.5 (High)

Threat Level: High – due to ease of exploitation, public PoC, and lack of patch.

Deep Dive & Mechanics

The vulnerability resides in the web server component of the Mercury MAC1200R firmware. The /web-static/ endpoint is intended to serve static files (e.g., images, CSS) from a specific directory. However, the server fails to properly sanitize user-supplied path traversal sequences (e.g., ../). By sending a request like:

GET /web-static/../../../etc/passwd HTTP/1.1

the server resolves the path outside the intended root directory, allowing an attacker to read any file accessible to the web server process. This includes configuration files, credentials, and potentially sensitive system files.

The exploit is trivial to execute and does not require authentication. Attackers can discover vulnerable devices using search engines with the dork "MAC1200R" && port="8888".

Vulnerable vs. Patched Code

Since no official patch exists, there is no patched code to compare. The vulnerable code likely resembles:

# Pseudocode of vulnerable handler
def handle_static(request):
    path = request.path.replace('/web-static/', '')
    # No sanitization of '..' sequences
    file_content = open('/var/www/static/' + path, 'r').read()
    return file_content

A patched version would sanitize the path:

import os

def handle_static(request):
    path = request.path.replace('/web-static/', '')
    # Resolve and validate path
    safe_path = os.path.realpath(os.path.join('/var/www/static/', path))
    if not safe_path.startswith('/var/www/static/'):
        return "Forbidden", 403
    file_content = open(safe_path, 'r').read()
    return file_content

Exploitation & Lab Setup

Red Team

Lab Setup:

1. Obtain a Mercury MAC1200R router (or use a firmware emulator like QEMU).
2. Connect to the router’s LAN or expose port 8888.
3. Use the provided Exploit-DB code to test.

Exploit-DB Code:

# Exploit Title: MAC 1200R - Directory Traversal
# Google Dork: "MAC1200R" && port="8888"
# Date: 2023/03/09
# Exploit Author: Chunlei Shang, Jiangsu Public Information Co., Ltd.
# Vendor Homepage: https://www.mercurycom.com.cn/
# Software Link: https://www.mercurycom.com.cn/product-1-1.html
# Version: all versions. (REQUIRED)
# Tested on: all versions.
# CVE : CVE-2021-27825

1. Attackers can easily find the targets through various search engines with keywords "MAC1200R" && port="8888".
2. Open the affected website like "http://IP:8888/web-static/".
3. For example:
1）http://60.251.151.2:8888/web-static/

2）http://222.215.15.70:8888/web-static/

Usage:

• Replace IP with the target router’s IP.
• Append path traversal sequences to read files, e.g., http://IP:8888/web-static/../../../etc/passwd.
• Use curl or a browser to retrieve the file content.

Blue Team

Detection:

• Monitor HTTP requests to port 8888 containing ../ or /web-static/ followed by path traversal patterns.
• Alert on repeated attempts to access /etc/passwd, /etc/shadow, or other sensitive files.

Hunting:

• Search logs for GET /web-static/ with ../ sequences.
• Correlate with known CVE-2021-27825 indicators.

Indicators of Compromise (IOCs)

• Network: HTTP GET requests to http://<IP>:8888/web-static/../../../etc/passwd or similar.
• File: Unauthorized access to /etc/passwd, /etc/shadow, /var/run/config.bin, or other system files.
• Logs: Web server logs showing path traversal patterns in the URI.

Detection Engineering

YARA Rule

rule CVE_2021_27825_Directory_Traversal {
    meta:
        description = "Detects directory traversal attempts against Mercury MAC1200R"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2021-27825"
    strings:
        $traversal = /\/web-static\/(\.\.\/)+/
        $sensitive = /(etc\/passwd|etc\/shadow|proc\/self\/environ)/
    condition:
        $traversal and $sensitive
}

Sigma Rule

title: CVE-2021-27825 Directory Traversal on Mercury MAC1200R
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP requests exploiting directory traversal in Mercury MAC1200R
author: Valters IT
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'GET'
        cs-uri-stem|contains: '/web-static/'
        cs-uri-query|contains: '..'
    condition: selection
falsepositives:
    - Legitimate use of '..' in URL (rare)
level: high

Suricata Rule

alert http any any -> any 8888 (msg:"CVE-2021-27825 Mercury MAC1200R Directory Traversal"; flow:to_server,established; content:"GET"; http_method; content:"/web-static/"; http_uri; content:"../"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

• Immediate: Disable remote access to port 8888 if not required. Use firewall rules to restrict access to trusted IPs only.
• Workaround: If possible, upgrade to a patched firmware version (none available as of now). Consider replacing the device with a supported alternative.
• Long-term: Monitor vendor advisories for a patch. Implement network segmentation to isolate IoT devices.
• Compensating Controls: Deploy a Web Application Firewall (WAF) to block path traversal patterns.

Valters IT signature: This report is generated by Valters IT DevSecOps AI Assistant. For questions, contact Secure Channels (Signal / Portal).

{/* [Security Hash: AE9A0CBE0489DD319FB609C6] */}