CVE-2024-28327

Executive Summary

CVE-2024-28327 exposes a critical security flaw in the Asus RT-N12+ B1 router: user passwords are stored in plaintext within the device’s local filesystem. This vulnerability allows any local attacker—such as an authenticated user on the router’s web interface or an attacker with physical or LAN access—to read the stored credentials and subsequently gain unauthorized administrative access. Once obtained, the attacker can modify router settings, intercept traffic, or pivot to other devices on the network.

The vulnerability is rooted in the router’s firmware, which writes the administrator password to a configuration file without hashing or encryption. This violates the fundamental security principle of never storing passwords in plaintext (CWE-312). The impact is severe for home and small-office users who rely on this device as their network gateway.

Supply Chain & Package Security

This vulnerability is not related to any open-source package ecosystem (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a consumer networking device. However, the lack of a vendor patch means users must rely on manual workarounds or device replacement.

CVSS Breakdown & Threat Level

The CVSS score is listed as 0.0 in the NVD data, likely because the vector was not fully computed. Based on the vulnerability characteristics, a reasonable CVSS v3.1 vector would be:

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
Base Score: 7.8 (High)

• Attack Vector (AV): Local – The attacker must have local access to the router (e.g., via LAN or physical console).
• Attack Complexity (AC): Low – No special conditions are required; the password is stored in a predictable location.
• Privileges Required (PR): Low – The attacker needs only a low-privileged account on the router (e.g., guest access) or physical access.
• User Interaction (UI): None – No user action is needed beyond the attacker’s own actions.
• Scope (S): Unchanged – The vulnerability does not affect resources beyond the router.
• Confidentiality (C): High – The plaintext password is directly exposed.
• Integrity (I): High – The attacker can modify all router settings.
• Availability (A): High – The attacker could disable the router or perform a denial-of-service.

Threat Level: High – Exploitation is trivial and requires minimal skill. The impact on network security is significant.

Deep Dive & Mechanics

The Asus RT-N12+ B1 router runs a custom Linux-based firmware. The web administration interface (typically at http://192.168.1.1) authenticates users via HTTP Basic Auth or a form-based login. The credentials are stored in a configuration file, often located at /etc/shadow or a proprietary file like /tmp/var/run/httpd.passwd.

In this vulnerable firmware version, the password is written to the file in plaintext. For example, the file might contain:

admin:admin123

or

admin:$1$salt$hash

but in this case, it is stored as:

admin:plaintextpassword

An attacker who gains access to the router’s filesystem (e.g., via a command injection vulnerability, physical serial console, or by exploiting another service) can simply read this file. Alternatively, if the attacker has LAN access and can sniff traffic, they might intercept the password during login (if HTTPS is not enforced). However, the primary attack vector is local file read.

The vulnerability is exacerbated by the fact that many users do not change the default password, and the router often runs services like Telnet or SSH with the same credentials.

Vulnerable vs. Patched Code

Vulnerable Code (Firmware version with plaintext storage):

// Example pseudo-code from the router's web server
void save_password(char *username, char *password) {
    FILE *fp = fopen("/etc/shadow", "w");
    fprintf(fp, "%s:%s\n", username, password); // Plaintext write
    fclose(fp);
}

Patched Code (Expected fix):

#include <crypt.h>
void save_password(char *username, char *password) {
    char *hash = crypt(password, "$6$random_salt$");
    FILE *fp = fopen("/etc/shadow", "w");
    fprintf(fp, "%s:%s\n", username, hash); // Hashed write
    fclose(fp);
}

The patched version uses the crypt() function with a SHA-512 hash and a random salt. This ensures that even if the file is read, the attacker cannot recover the original password without brute-forcing.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Access to the router’s LAN (e.g., connected via Ethernet or Wi-Fi).
• Ability to execute commands on the router (e.g., via a command injection vulnerability or physical access).

Step 1: Identify the router’s IP address.

nmap -sn 192.168.1.0/24

Assume the router is at 192.168.1.1.

Step 2: Gain shell access. If the router has Telnet enabled (common on older firmware):

telnet 192.168.1.1

Default credentials: admin/admin or root/root.

Step 3: Read the password file.

cat /etc/shadow

or

cat /tmp/var/run/httpd.passwd

Step 4: Use the plaintext password to log into the web interface and modify settings.

curl -u admin:plaintextpassword http://192.168.1.1/start_apply.htm -d "action=reboot"

Automated Exploit (Python):

import requests
import sys

def exploit(router_ip, username, password):
    # Attempt to read password file via command injection (if available)
    # This is a placeholder; actual exploit depends on other vulns.
    pass

if __name__ == "__main__":
    exploit("192.168.1.1", "admin", "admin")

Blue Team (Detection & Hardening)

Detection:

• Monitor for unauthorized access to the router’s web interface.
• Look for repeated failed login attempts (though this vulnerability bypasses login).
• Check for unexpected Telnet or SSH sessions.

Hardening:

1. Change the default password immediately.
2. Disable Telnet and SSH if not needed.
3. Use a strong, unique password.
4. Isolate the router on a separate VLAN.
5. Monitor for firmware updates from Asus (though none are expected).
6. Consider replacing the device with a supported model.

Indicators of Compromise (IOCs)

• File Paths: /etc/shadow, /tmp/var/run/httpd.passwd, /etc/passwd
• Network Traffic: Unencrypted HTTP traffic to the router’s web interface (port 80).
• Processes: httpd or lighttpd running with root privileges.
• Log Entries: Successful login from an unexpected IP address; commands executed via web interface.
• Hashes: If the password is hashed, look for weak hashes (e.g., MD5 without salt).

Detection Engineering

YARA Rule

rule Asus_RT_N12_Plaintext_Password {
    meta:
        description = "Detects plaintext password storage in Asus RT-N12+ B1 config files"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2024-28327"
    strings:
        $plaintext = /^[a-zA-Z0-9]+:[a-zA-Z0-9!@#$%^&*()_+\-=\[\]{}|;':\",.\/<>?]+$/ 
        $shadow_header = "root:" 
        $httpd_passwd = "admin:"
    condition:
        ($plaintext at 0) and ($shadow_header or $httpd_passwd)
}

Sigma Rule

title: Asus RT-N12+ B1 Plaintext Password Access
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects attempts to read the password file on an Asus RT-N12+ B1 router
author: Valters IT
date: 2025-04-10
logsource:
    category: process_creation
    product: linux
detection:
    selection:
        Image|endswith: '/cat'
        CommandLine|contains: '/etc/shadow'
    condition: selection
falsepositives:
    - Legitimate administrative activity
level: high

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 80 (msg:"Asus RT-N12+ B1 Plaintext Password Exfiltration"; flow:to_server,established; content:"GET /"; http_uri; content:"/etc/shadow"; distance:0; nocase; classtype:attempted-recon; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Change the password to a strong, unique value.
2. Disable remote management (WAN access to the web interface).
3. Disable Telnet and SSH if not required.
4. Update firmware if Asus releases a patch (check https://www.asus.com/support/).
5. Replace the router with a model that receives security updates.

Long-Term:

• Implement network segmentation to isolate IoT devices.
• Use a firewall to restrict outbound traffic from the router.
• Monitor for CVEs affecting your router model.

Valters IT Signature: This report was generated by Valters IT DevSecOps AI. For questions, contact security@valters-it.com.