Command Injection in Trendnet TEW-635BRM Router

Executive Summary

The TRENDnet TEW-635BRM router, running firmware version V1.00.03, contains a command injection vulnerability in the `/sbin/rc` binary. The vulnerable function, `ipoa_test`, is triggered during IPoA (IP over ATM) WAN connection setup.

This function retrieves the NVRAM variable `ipoa_ipaddr` without sanitization and embeds it directly into a shell command using `sprintf()`, which is then executed via `system()`. Since `ipoa_ipaddr` is fully attacker-controlled, malicious actors can inject shell metacharacters (such as `;` or backticks) to execute arbitrary commands as root, leading to complete device compromise.

The attack requires write access to NVRAM, which can be achieved by modifying and uploading a configuration file through the web interface.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an attacker to execute arbitrary commands on the affected device with root privileges remotely. This can lead to complete compromise of the router.

• Unauthorized control over the device
• Potential interception or manipulation of network traffic
• Use of the compromised device as a pivot point for further attacks within the network
• Disruption of network services or denial of service

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by checking if the device is running the vulnerable firmware version V1.00.03 of the TRENDnet TEW-635BRM router. Since the vulnerability involves command injection via the NVRAM variable ipoa_ipaddr, one detection method is to verify if arbitrary commands can be injected and executed through manipulation of this variable.

A proof of concept involves injecting a command that creates a file (e.g., /tmp/poc_result) with a confirmation message. This can be tested by modifying and uploading a configuration file through the web interface that sets the ipoa_ipaddr variable to include shell metacharacters such as ";" or backticks to execute commands.

• Check the firmware version of the device to confirm if it is V1.00.03.
• Attempt to inject a command via the ipoa_ipaddr NVRAM variable by uploading a configuration file through the web interface.
• Verify if a file like /tmp/poc_result is created on the device, indicating successful command injection.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include switching to a different device since the affected product is end-of-life and no official patches are available.

If continuing to use the device, restrict access to the web interface to prevent unauthorized modification of NVRAM variables.

Apply network-level protections such as firewall rules to block remote access to the device's management interfaces.

Avoid using the vulnerable function by disabling IPoA WAN connection setup if possible.

Long term, the vendor recommends switching devices as no official fix is provided.

Useful 0 Not Useful 0

Compliance Impact

The vulnerability allows remote command injection leading to complete device compromise, which could result in unauthorized access to sensitive data or disruption of services.

Such a compromise may impact compliance with standards and regulations like GDPR and HIPAA, which require protection of personal and sensitive information and maintaining system integrity.

However, the affected device is end-of-life since 2011 and no longer supported, which complicates mitigation and may increase compliance risks if still in use.

Useful 0 Not Useful 0