Tuesday, July 23, 2024

Cable Haunt – Critical Vulnerability Let Hackers Control Cable Modems Remotely

Researchers discovered as critical vulnerability dubbed Cable Haunt affects cable modems from different manufacturers across the globe.

The vulnerability enables a remote attacker to gain complete control over the modem through its endpoint.

Successful exploitation allows attackers to intercept private messages, redirect traffic, or participate in botnets.

Cable Haunt vulnerability was discovered by a team of Danish security researchers in Broadcom cable modems.

Cable Haunt Attacks Middleware

The vulnerability targets the middleware running on the chip used in the Broadcom cable modems, the middleware is the real-time operating system in cable modems that runs all the networking tasks.

It affects multiple vendors as the same software being used by various cable modem manufacturers to create their cable modem firmware.

All the traffic goes through the cable modem middleware (CM), by gaining control over it attackers can manipulate any traffic going through the modem.

How the Attack Works

The attack is a two-step process: An attacker should gain access to the vulnerable endpoints through local networks such as browsers, this can be done by making the victim opening a malicious link in a browser.

The exploit not only the browser, but it can also be executed in any place where running the code can reach IP on the local network.

Next, the attacker needs to hit the vulnerable endpoint with buffer overflow attack, by creating a crafted message a remote attacker can manipulate the modem to execute arbitrary code specified by a remote attacker.

Once the code executed attackers can gain complete control over the modem and can perform various operation such as

  • Change default DNS server
  • Conduct remote man-in-the-middle attacks
  • Hot-swap code or even the entire firmware
  • Upload, flash, and upgrade firmware silently
  • Disable ISP firmware upgrade
  • Change every config file and settings
  • Get and Set SNMP OID values
  • Change all associated MAC Addresses
  • Change serial numbers
  • Be exploited in botnet

Modems Affected

Researchers estimated that “more than 200 million modems may be or might have been vulnerable in Europe alone and there is no way to track the vulnerability spread”.

Here is the list of vulnerable modems:

ModelFirmware VersionPortDefault Credentials
Sagemcom F@st 389050.10.19.*6080spectrum:spectrum (Authorization: Basic)
Sagemcom F@st 3686SIP_3.428.0-*6080spectrum:spectrum (Authorization: Basic)
Technicolor TC7230STEB 01.258080No authorization needed
Netgear C6250EMRV2.01.058080No authorization needed
Netgear CG3700EMRV2.01.038080No authorization needed
Sagemcom F@st 389005.76.6.3aunknownunknown
Sagemcom F@st 36864.83.0unknownunknown
COMPAL 7284E5.510.5.11unknownunknown
COMPAL 7486E5.510.5.11unknownunknown
Netgear CG3700EMRV2.01.058080No authorization needed

As the cable Haunt allows attackers to gain complete access to the modem it is hard to detect the infection as the attacker can hide the tracks.

Researchers also stated that there is no evidence of active exploitation, and this attack doesn’t break SSL/TLS encryption.

A tool has been released to check whether your modem is vulnerable, the tool can be downloaded from here.

Here you find the detailed Technical report explaining the Cable Haunt vulnerability and the PoC of the attack.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity and hacking news updates


Latest articles

Beware Of Dating Apps Exposing Your Personal And Location Details To Cyber Criminals

Threat actors often attack dating apps to steal personal data, including sensitive data and...

Hackers Abusing Google Cloud For Phishing

Threat actors often attack cloud services for several illicit purposes. Google Cloud is targeted...

Two Russian Nationals Charged for Cyber Attacks against U.S. Critical Infrastructure

The United States has designated Yuliya Vladimirovna Pankratova and Denis Olegovich Degtyarenko, two members...

Threat Actors Taking Advantage of CrowdStrike BSOD Bug to Deliver Malware

Threat actors have been found exploiting a recently discovered bug in CrowdStrike's software that...

NCA Shut’s Down the Most Popular “digitalstress” DDoS-for-hire Service

The National Crime Agency (NCA) has successfully infiltrated and dismantled one of the most...

Play Ransomware’s Linux Variant Attacking VMware ESXi Servers

A new Linux variant of Play ransomware targets VMware ESXi environments, which encrypts virtual...

SonicOS IPSec VPN Vulnerability Let Attackers Cause Dos Condition

SonicWall has disclosed a critical heap-based buffer overflow vulnerability in its SonicOS IPSec VPN....
Guru baran
Guru baranhttps://gbhackers.com
Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Free Webinar

Low Rate DDoS Attack

9 of 10 sites on the AppTrana network have faced a DDoS attack in the last 30 days.
Some DDoS attacks could readily be blocked by rate-limiting, IP reputation checks and other basic mitigation methods.
More than 50% of the DDoS attacks are employing botnets to send slow DDoS attacks where millions of IPs are being employed to send one or two requests per minute..
Key takeaways include:

  • The mechanics of a low-DDoS attack
  • Fundamentals of behavioural AI and rate-limiting
  • Surgical mitigation actions to minimize false positives
  • Role of managed services in DDoS monitoring

Related Articles