3 ms·

These endpoints are available in modem only mode, but everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return t

These endpoints are available in modem only mode, but everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address. If you’re in modem only mode, block HTTP traffic to 192.168.100.1 outbound from your firewall just to be sure. Seems relatively low impact, but still pretty bad. Not surprising from VM given the quality of their firmware.

aaronmdjones 5y ago
I've been running my VM superhubs in modem-only mode ever since I got them; with OpenWRT on my own router behind it. I've been blocking traffic to RFC1918 ranges (all of them) that attempts to egress the WAN interface for just as long. It's almost like I knew that eventually, someone was going to find a vulnerability in their web panel, and I wanted to make sure it wouldn't be exploitable. Oh wait, I didn't know. It's just common sense.
stordoff 5y ago
> everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address What does it return in modem only mode? I've verified that <hubip>/snmpGet?oid=1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1 on my Hub 3 returns: > { > "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$xxxxxxxx" [public IP address encoded in hexadecimal] > } but I can't currently test it in modem only mode.
- aaronmdjones 5y ago
  I did SSH port forwarding through my router so that I could access the modem; $ ssh -L 127.0.0.1:1234:192.168.100.1:80 root@router $ curl 'http://127.0.0.1:1234/snmpGet?oid=1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1' { "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$00000000" } It does not appear to work in modem mode.
- dangerface 5y ago
  I tested mine in modem mode and it returns 0s for the public ip address, it could be safe or it could just need a different oid or something. I blocked the ip from my router just to be on the safe side. { "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$00000000" }

aaronmdjones 5y ago

I've been running my VM superhubs in modem-only mode ever since I got them; with OpenWRT on my own router behind it. I've been blocking traffic to RFC1918 ranges (all of them) that attempts to egress the WAN interface for just as long. It's almost like I knew that eventually, someone was going to find a vulnerability in their web panel, and I wanted to make sure it wouldn't be exploitable. Oh wait, I didn't know. It's just common sense.

stordoff 5y ago

> everyone I’ve asked who has a SH3 says that they’re not affected by this and the endpoint doesn’t return the IP address What does it return in modem only mode? I've verified that <hubip>/snmpGet?oid=1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1 on my Hub 3 returns: > { > "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$xxxxxxxx" [public IP address encoded in hexadecimal] > } but I can't currently test it in modem only mode.

aaronmdjones 5y ago
I did SSH port forwarding through my router so that I could access the modem; $ ssh -L 127.0.0.1:1234:192.168.100.1:80 root@router $ curl 'http://127.0.0.1:1234/snmpGet?oid=1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1' { "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$00000000" } It does not appear to work in modem mode.
dangerface 5y ago
I tested mine in modem mode and it returns 0s for the public ip address, it could be safe or it could just need a different oid or something. I blocked the ip from my router just to be on the safe side. { "1.3.6.1.4.1.4115.1.20.1.1.1.7.1.3.1":"$00000000" }