MoFi CVE -2021-27715 Security Advisory

Security Advisory

An issue discovered in MoFi Network MOFI4500-4GXeLTE-V2 3.5.6-xnet-5052 allows attackers to bypass the authentication and execute arbitrary code via crafted HTTP requests. 
 

Summary  

A critical vulnerability has been identified in MOFI4500-4GXeLTE-V2, which permits an attacker to exploit broken authentication mechanisms and execute arbitrary commands as root on the affected system. This vulnerability has been assigned the Common Vulnerabilities and Exposures (CVE) identifier: CVE-2021-27715 
 

CVSS 

• CVSS Score: 10.0  
• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:N/I:H/A:H
• Vendor:  Mofi Network Inc
• Affected Product: MoFi Network MOFI4500-4GXeLTE-V2
• Affected Versions:  3.5.6-xnet-5052 

 
Impact

The identified vulnerability is caused by broken authentication and provides attackers unrestricted access to the API functionality. This opens avenues for malicious entities to modify usernames and passwords, retrieve device configuration details, set PIN codes, acquire kernel logs and GPS coordinates, and view and modify WAN passwords. Coupled with the command injection vector, this vulnerability escalates the severity as attackers can exploit it to execute arbitrary commands with root privileges. Consequently, an attacker could gain unauthorized access and command execution on the affected system, leading to a potential total compromise of the system. 
 

Details

The vulnerability stems from a combination of broken authentication and command injection flaws in the software. The flaw can be exploited from internal and external networks, making it especially dangerous as it doesn't require prior access to the target's internal network. 
 

Exploit Vector

An attacker can leverage this vulnerability by sending specially crafted HTTP requests to the affected service, bypassing the authentication mechanisms, and injecting malicious commands to be executed on the target system. 
 

Mitigation

The vendor was informed of the issue and quickly published an update that mitigated the vulnerability. Updated devices are not affected.