CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
58.6%
Several models of Hughes high-performance broadband satellite modems are potentially vulnerable to several issues if not appropriately configured.
Several models of Hughes high-performance broadband satellite modems are potentially vulnerable to the following issues if not appropriately configured:
CWE-20: Improper Input Validation - CVE-2016-9494
The device’s advanced status web page that is linked to from the basic status web page does not appear to properly parse malformed GET requests. This may lead to a denial of service.
CWE-798: Use of Hard-coded Credentials - CVE-2016-9495
Access to the device’s default telnet port (23) using one of a few default credentials shared among all devices.
CWE-306: Missing Authentication for Critical Function - CVE-2016-9496
An unauthenticated user may send an HTTP GET request to http://[ip]/com/gatewayreset
or http://[ip]/cgi/reboot.bin
to cause the modem to reboot.
CWE-288: Authentication Bypass Using an Alternate Path or Channel - CVE-2016-9497
By default, port 1953 is accessible via telnet and does not require authentication. An unauthenticated remote user can access many administrative commands via this interface, including rebooting the modem.
According to the reporter, the following models may be affected:
* HN7740S
* DW7000
* HN7000S/SM
An unauthenticated remote attacker may be able to cause a denial of service via one of several methods, or can access some administrative commands via telnet.
Hughes has provided the following statement:
“The Hughes system has the ability to configure the modem which will prevent access and exploitation of the listed potential vulnerabilities. Hughes has provided service providers with documentation on the parameters and current software versions required to address these potential vulnerabilities. Customers should contact their service provider to ensure the locked down configuration is pushed to their devices.”
Update the firmware
DW7000, HN7740S, and HN7000S/SM devices running software versions prior to 6.9.0.34 are vulnerable. Devices running 6.9.0.34 or higher can be configured to prevent exploit of the listed potential vulnerabilities.
Restrict network access
Restrict network access to the Hughes modem and devices on its local network that use open protocols like HTTP.
614751
Filter by status: All Affected Not Affected Unknown
Filter by content: __ Additional information available
__ Sort by: Status Alphabetical
Expand all
Javascript is disabled. Click here to view vendors.
Notified: March 16, 2016 Updated: February 15, 2017
Statement Date: February 14, 2017
Affected
“The Hughes system has the ability to configure the modem which will prevent access and exploitation of the listed potential vulnerabilities. Hughes has provided service providers with documentation on the parameters and current software versions required to address these potential vulnerabilities. Customers should contact their service provider to ensure the locked down configuration is pushed to their devices.”
DW7000, HN7740S, and HN7000S/SM devices running software versions prior to 6.9.0.34 are vulnerable. According to the vendor, devices running 6.9.0.34 or higher can be configured to prevent exploit of the listed potential vulnerabilities.
Updated: February 27, 2018
Affected
We have not received a statement from the vendor.
We are not aware of further vendor information regarding this vulnerability.
Group | Score | Vector |
---|---|---|
Base | 7.3 | AV:A/AC:L/Au:N/C:P/I:P/A:C |
Temporal | 6.2 | E:POC/RL:W/RC:C |
Environmental | 4.7 | CDP:ND/TD:M/CR:ND/IR:ND/AR:ND |
Thanks to the reporter who wishes to remain anonymous.
This document was written by Garret Wassermann.
CVE IDs: | CVE-2016-9494, CVE-2016-9495, CVE-2016-9496, CVE-2016-9497 |
---|---|
Date Public: | 2017-02-15 Date First Published: |
CVSS2
Attack Vector
ADJACENT_NETWORK
Attack Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:A/AC:L/Au:N/C:C/I:C/A:C
CVSS3
Attack Vector
ADJACENT
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
NONE
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.0/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
EPSS
Percentile
58.6%