TG8 Firewall Under Attack: Pre-Auth RCE Exposes Devices to Full Compromise (CVE-2021-4470)

Overview

CVE-2021-4470 details a critical pre-authentication remote code execution (RCE) vulnerability affecting the TG8 Firewall. This flaw allows an unauthenticated attacker to execute arbitrary operating system commands with root privileges on the affected device. The vulnerability resides in the runphpcmd.php endpoint and stems from the lack of input validation on the syscmd POST parameter.

Technical Details

The TG8 Firewall’s runphpcmd.php endpoint is intended to execute system commands. However, the syscmd POST parameter, which provides the command to be executed, is passed directly to the underlying system without any validation or sanitization. This allows a remote, unauthenticated attacker to inject malicious commands that will be executed as the root user. Essentially, by sending a specially crafted HTTP POST request to runphpcmd.php, an attacker can gain complete control over the firewall.

Specifically, a request like the following would exploit the vulnerability:

    POST /runphpcmd.php HTTP/1.1
    Host: [Target IP Address]
    Content-Type: application/x-www-form-urlencoded

    syscmd=id
    

This request would execute the id command, revealing the user’s identity (which would be root). More dangerous commands can easily be substituted for full system compromise.

CVSS Analysis

Unfortunately, the CVSS score is currently unavailable for CVE-2021-4470, but given the pre-authentication nature of the vulnerability and the ability to execute arbitrary code as root, it can be reasonably assumed to be a Critical severity vulnerability with a CVSS score likely in the 9.0-10.0 range. The absence of user interaction, remote exploitability, and the impact of complete system compromise all point towards this classification.

Possible Impact

The impact of CVE-2021-4470 is severe. Successful exploitation grants the attacker complete control over the TG8 Firewall, allowing them to:

• Execute arbitrary system commands as root.
• Access sensitive data stored on the device.
• Modify firewall rules to bypass security measures.
• Install malware or backdoors for persistent access.
• Use the compromised firewall as a pivot point to attack other devices on the network.
• Disrupt network services and cause denial-of-service (DoS) attacks.

In essence, a compromised firewall can render an entire network vulnerable.

Mitigation or Patch Steps

Given that TG8Security is no longer active, a formal patch is unlikely to be released. The following mitigation steps are recommended:

1. Discontinue Use: The most effective mitigation is to immediately discontinue the use of the TG8 Firewall and replace it with a supported and actively maintained firewall solution.
2. Network Segmentation: If immediate replacement is not feasible, isolate the TG8 Firewall on a segmented network to limit the potential impact of a compromise. Ensure it is not directly exposed to the internet.
3. Web Application Firewall (WAF): Consider deploying a WAF in front of the firewall to filter out malicious requests targeting the runphpcmd.php endpoint. This is a temporary solution and should not be considered a permanent fix. WAF rules to block requests containing shell command characters in the `syscmd` parameter could mitigate some attacks.
4. Monitor Logs: Closely monitor the firewall’s logs for any suspicious activity, such as requests to runphpcmd.php or unusual system commands.

Important Note: These mitigations are only temporary workarounds. Replacing the vulnerable firewall is the only reliable solution.

References

• SSD Advisory: TG8 Firewall PreAuth RCE and Password Disclosure
• TG8 Security (Archived)
• VulnCheck Advisory: TG8 Firewall Unauthenticated RCE via runphpcmd.php