CVE-2024-28325

Executive Summary

CVE-2024-28325 identifies a cleartext credential storage vulnerability in the Asus RT-N12+ B1 router. The router stores sensitive authentication data (e.g., admin passwords, Wi-Fi keys) in plaintext within its configuration files or web interface. This allows any local attacker with access to the router’s filesystem or management interface to extract credentials and gain unauthorized administrative control. The vulnerability is particularly dangerous in environments where physical or network access to the router is possible, enabling attackers to modify settings, intercept traffic, or pivot to internal networks.

Supply Chain & Package Security

This vulnerability does not affect NPM, PyPI, Go, or Ruby packages. It is a hardware/firmware issue specific to the Asus RT-N12+ B1 router.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0, likely due to incomplete or missing vector data. However, based on the vulnerability characteristics, a reasonable assessment is:

• Attack Vector (AV): Local (AV:L) – requires physical or local network access.
• Attack Complexity (AC): Low (AC:L) – no special conditions.
• Privileges Required (PR): None (PR:N) – attacker does not need prior access.
• User Interaction (UI): None (UI:N) – no user action needed.
• Scope (S): Unchanged (S:U) – affects only the router.
• Confidentiality (C): High (C:H) – credentials exposed.
• Integrity (I): High (I:H) – attacker can modify settings.
• Availability (A): Low (A:L) – could disrupt router operation.

Estimated CVSS Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:L
Estimated Score: 7.8 (High)

Threat Level: High – due to ease of exploitation and potential for full device compromise.

Deep Dive & Mechanics

The Asus RT-N12+ B1 router stores credentials (e.g., admin password, Wi-Fi PSK) in cleartext within its configuration files, typically located in /etc/ or accessible via the web interface’s backup/restore functionality. The vulnerability stems from improper encryption or hashing of sensitive data during storage.

Attack Vector:

• Local Access: An attacker with physical access to the router can connect via serial console, SSH (if enabled), or by exploiting other vulnerabilities to gain shell access.
• Network Access: If the router’s web interface is exposed on the LAN, an attacker can download the configuration backup file (e.g., Settings_Backup.conf) which contains plaintext credentials.

Exploitation Steps:

1. Gain access to the router’s filesystem (e.g., via default credentials, SSH brute-force, or physical console).
2. Read configuration files (e.g., /etc/shadow, /etc/config/*, or backup files).
3. Extract plaintext passwords and Wi-Fi keys.
4. Use credentials to log into the admin interface and modify settings (e.g., DNS, firewall, port forwarding).

Impact:

• Full administrative control of the router.
• Ability to intercept, redirect, or monitor network traffic.
• Potential to pivot to internal network devices.

Vulnerable vs. Patched Code

Vulnerable Code (Example from firmware):
The router’s web interface or configuration scripts store credentials without encryption. For instance, in a PHP or CGI script:

// Vulnerable: stores password in plaintext
$admin_password = $_POST['password'];
file_put_contents('/etc/admin_password', $admin_password);

Patched Code (Hypothetical):
A secure implementation would hash the password before storage:

// Patched: hashes password before storage
$admin_password = password_hash($_POST['password'], PASSWORD_BCRYPT);
file_put_contents('/etc/admin_password_hash', $admin_password);

Note: No official patch has been released by Asus. Users must rely on workarounds.

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Asus RT-N12+ B1 router with default or known credentials.
• Local network access or physical access.

Exploitation Steps:

1. Access Router Shell:

   • Use default credentials (admin/admin) via SSH or Telnet.
   • Or connect via serial console (e.g., using a USB-to-TTL adapter).

2. Extract Credentials:

   cat /etc/shadow
   cat /etc/config/*.conf
   

3. Download Configuration Backup:

   • Navigate to http://192.168.1.1/Backup.asp (or similar) and download the backup file.
   • Extract plaintext passwords from the file.

4. Modify Settings:

   • Log into the web interface with extracted credentials.
   • Change DNS settings to redirect traffic to a malicious server.

Example Script (Python):

import requests

url = "http://192.168.1.1/Backup.asp"
response = requests.get(url, auth=('admin', 'admin'))
with open('backup.conf', 'wb') as f:
    f.write(response.content)
# Parse backup.conf for plaintext passwords

Blue Team (Defense & Detection)

Detection Steps:

• Monitor for unauthorized access to the router’s web interface or SSH.
• Check for unusual configuration changes (e.g., DNS, firewall rules).
• Use network monitoring to detect traffic redirection.

Mitigation Workarounds:

• Change default credentials immediately.
• Disable remote management (WAN access).
• Use a strong, unique password for the admin account.
• Regularly backup and audit router configurations.

Indicators of Compromise (IOCs)

• File Hashes (Configuration Backup):
  • Settings_Backup.conf – contains plaintext credentials.
• Network Indicators:
  • Unusual DNS queries to unknown servers.
  • Traffic to IP addresses not in normal usage.
• System Indicators:
  • Modified /etc/shadow or /etc/config/* files.
  • New SSH keys or unauthorized user accounts.
• Log Entries:
  • Repeated failed login attempts followed by success.
  • Configuration changes outside of normal maintenance windows.

Detection Engineering

YARA Rule

rule Asus_RT_N12_Credentials_Cleartext {
    meta:
        description = "Detects cleartext credentials in Asus RT-N12+ B1 configuration files"
        author = "Valters IT"
        date = "2024-03-15"
        reference = "CVE-2024-28325"
    strings:
        $password = "admin_password" nocase
        $wifi_key = "wpa_psk" nocase
        $plaintext = /password\s*=\s*[^\s]+/
    condition:
        any of ($password, $wifi_key) and $plaintext
}

Sigma Rule

title: Asus RT-N12+ B1 Cleartext Credential Access
id: 12345678-1234-1234-1234-123456789012
status: experimental
description: Detects access to configuration files containing plaintext credentials on Asus RT-N12+ B1 routers
author: Valters IT
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/cat'
        CommandLine|contains:
            - '/etc/shadow'
            - '/etc/config'
            - 'Backup.asp'
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (msg:"Asus RT-N12+ B1 Configuration Backup Download"; flow:to_server,established; content:"GET"; http_method; content:"/Backup.asp"; http_uri; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change the router’s admin password to a strong, unique value.
2. Disable remote management (WAN access) if not required.
3. Update firmware to the latest version (if available).
4. Restrict physical access to the router.

Long-Term Fix:

• Asus must release a firmware update that encrypts or hashes stored credentials.
• Users should consider replacing the router with a model that supports secure credential storage.

Workarounds:

• Use a separate firewall or VPN to segment the router from sensitive networks.
• Monitor router logs for unauthorized access attempts.

Valters IT