CVE Report: Root Authentication Bypass on Arris NVG443B

CVE Score: 6.8 MEDIUM

Vulnerability Overview

A root authentication bypass vulnerability exists in the Arris NVG443B router, commonly supplied to customers of Frontier ISP. This vulnerability allows an attacker with physical access to gain root-level privileges to the device's operating system, potentially compromising the security of the network.

Affected Device: Arris NVG443B Router

Affected Firmware: Version 9.3.0h3d36

Discoverer: Gavin Kelsey (aliases: HotPocket/nullptr)

Technical Details

The vulnerability exists due to a flaw in the router's login shell (/bin/cshell), specifically in the function located at RVA 0x165C0. When exploited, this vulnerability allows an attacker to bypass the authentication mechanism and gain root-level access to the device.

Vulnerability Mechanism

During security testing via UART connection, it was discovered that sending the command ^e terminates the sdb task. When this task is terminated, the login shell erroneously grants root access without requiring authentication credentials.

Steps to Reproduce

Connect to the router via UART interface
Access the login shell
Inject the command ^e to terminate the sdb task
Observe that the login shell grants root access without prompting for credentials

This exploitation sequence effectively bypasses all authentication mechanisms, granting complete control over the router's operating system.

Impact Assessment

The vulnerability has been assigned a CVSS score of 6.8 (MEDIUM) based on the following factors:

Requires physical access to the device (reducing severity)
Provides complete system access (increasing severity)
No special tools or advanced knowledge required for exploitation

Potential Consequences

Unauthorized root access to the router's operating system
Exposure of sensitive filesystem contents
Access to password hashes of administrative and SSH user accounts
Potential modification of router configuration and firmware
Possible network traffic interception and manipulation

Remediation

The vendor, Arris, has been notified of this issue and has released a patch to address the vulnerability.

Credit & Disclosure Timeline

This vulnerability was discovered and reported by Gavin Kelsey during security testing.

Responsible disclosure procedures were followed, allowing the vendor time to develop and release a patch before public disclosure.