Description
The Cisco WAP4410N access point with firmware through 2.0.6.1, WRVS4400N router with firmware 1.x through 1.1.13 and 2.x through 2.0.2.1, and RVS4000 router with firmware through 2.0.3.2 allow remote attackers to read credential and configuration data, and execute arbitrary commands, via requests to the test interface on TCP port 32764, aka Bug IDs CSCum37566, CSCum43693, CSCum43700, and CSCum43685.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
SerComm Device Remote Code Execution
exploit/linux/misc/sercomm_exec
-
SerComm Network Device Backdoor Detection
auxiliary/scanner/misc/sercomm_backdoor_scanner
Exploit-DB 1
- SerComm Device - Remote Code Execution (Metasploit) EDB-30915 · remote · Jan 14, 2014 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 56292 third-party-advisory
- 20140110 Undocumented Test Interface in Cisco Small Business Devices vendor-advisory
- cisco-small-cve20140659-priv-esc(90233) vdb-entry
- 64776 vdb-entry
- 1029580 vdb-entry
- http://tools.cisco.com/security/center/viewAlert.x?alertId=32381
- 1029579 vdb-entry
- https://github.com/elvanderb/TCP-32764