ConnectedIO’s 3G/4G Routers Vulnerability Let Hackers Execute Malicious Code

Critical issues in ConnectedIO’s ER2000 edge routers have been discovered, and an attacker can leverage them to compromise the cloud infrastructure completely, remotely execute malicious code, and expose all user and device data.

A 3G/4G router serves as a gateway between the remote site and the internet and enables the XIoT devices on that site to connect online. Organizations may remotely manage their gadgets due to this connectivity. 

EHA

ConnectedIO’s firmware releases have fixed all of the flaws discovered by Team82.

Document
FREE Demo

Deploy Advanced AI-Powered Email Security Solution

Implementing AI-Powered Email security solutions “Trustifi” can secure your business from today’s most dangerous email threats, such as Email Tracking, Blocking, Modifying, Phishing, Account Take Over, Business Email Compromise, Malware & Ransomware

Details of the Vulnerability

The flaws impact the ConnectedIO platform versions v2.1.0 and earlier, particularly the 4G ER2000 edge router and cloud services, which might be chained, allowing attackers to execute arbitrary code on cloud-based devices without direct access.

Additionally, flaws have also been found in the MQTT communication protocol, which is used to connect devices and the cloud, including the use of hard-coded authentication credentials, which could be exploited to register a rogue device and gain access to MQTT messages that contain router passwords, SSIDs, and device identifiers.

Using the disclosed IMEI information, the threat actor may not only impersonate any device of their choice but also force them to execute arbitrary commands displayed via specially crafted MQTT messages.

ConnectedIO’s 3G/4G Routers
Devices connecting to ConnectedIO’s cloud use hardware identifiers to authenticate in front of the cloud

This is accomplished by using the bash command with the opcode “1116,” which runs a remote command “as-is.”

This command, which requires no additional authentication beyond the ability to write to the correct topic, allows to run arbitrary commands on all devices. It does not validate if the sender of the commands is an authorized issuer.

Researchers have discovered four new vulnerabilities that allow attackers to execute remote code on all connected devices. These vulnerabilities are identified as CVE-2023-33375, CVE-2023-33376, CVE-2023-33377, and CVE-2023-33378.

These vulnerabilities, if exploited, might represent a severe risk to thousands of enterprises throughout the world, allowing attackers to disrupt business and production while also gaining access to internal networks.

Patch Available

ConnectedIO has issued firmware upgrades that address all of the vulnerabilities discovered to resolve these issues. Users are automatically protected since these upgrades were applied to the cloud infrastructure and edge devices.

Protect yourself from vulnerabilities using Patch Manager Plus to patch over 850 third-party applications quickly. Take advantage of the free trial to ensure 100% security.

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.