CVE-2023-43478

published 2023-09-20

CVE-2023-43478: fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images…

Priority P1 90 critical 9.8 CVSS 3.1

AV N AC L PR N UI N S U C H I H A H

ITW VulnCheck KEV

fake_upload.cgi on the Telstra Smart Modem Gen 2 (Arcadyan LH1000), firmware versions < 0.18.15r, allows unauthenticated attackers to upload firmware images and configuration backups, which could allow them to alter the firmware or the configuration on the device, ultimately leading to code execution as root.

Affected

2 ranges

Vendor	Product	Version range	Fixed in
telstra	arcadyan_lh1000_firmware	< 0.18.15r	0.18.15r
telstra	smart_modem_gen_2	< 0.18.15r	0.18.15r

Detection & IOCs extracted from sources · hover to see the quote

path /fake_upload.cgi↗

path /hninh987R47san82.htm↗

path /login_fw.cgi↗

command openssl enc -d -aes-256-cbc -md MD5 -salt -in LH1000V1-backup.cfg -out dec.tgz -k '2&15u69A'↗

command curl -F httoken=$token -F [email protected] http://$LH1000/fake_upload.cgi↗

other 2&15u69A↗

filename LH1000V1-backup.cfg↗

path /tmp/shell.sh↗

path /sbin/arc_deviceready↗

• → Monitor for unauthenticated POST requests to /fake_upload.cgi — legitimate firmware/config uploads should require authentication; unauthenticated multipart form-data POSTs to this endpoint are indicative of exploitation. ↗
• → Alert on any HTTP GET/access to /hninh987R47san82.htm from untrusted or unauthenticated sources, as this hidden page is the entry point for the unauthenticated upload form. ↗
• → Detect unexpected telnet (port 23) connections to the LH1000 device after a reboot, which may indicate a malicious configuration backup was uploaded enabling a root telnet shell. ↗
• → Look for the hardcoded encryption key '2&15u69A' in network traffic or files, which is used to encrypt/decrypt LH1000 configuration backups and indicates an attacker is crafting a malicious config. ↗
• → Inspect uploaded configuration backups for the presence of ARC_TELNETD_ENABLE=1, ARC_SYS_RDFlag=1, or ARC_SYS_MPTEST=1 in .glbcfg, which are used to enable a root telnet backdoor. ↗
• → Detect multipart/form-data POST requests to /fake_upload.cgi containing an 'httoken' field without a preceding authenticated session, as the token can be obtained unauthenticated via ArcBase._t() in JavaScript. ↗

• · The hardcoded AES-256-CBC encryption key '2&15u69A' is used for ALL LH1000 configuration backups on affected firmware versions, meaning any attacker with a valid backup from any device can craft a malicious config for any other device. ↗
• · Uploading a misconfigured backup could permanently brick the device beyond hardware factory reset recovery — exploitation should be performed with caution. ↗
• · The login_fw.cgi key check is entirely bypassable — requests to fake_upload.cgi succeed even without the key, making the authentication gate ineffective. ↗
• · The vulnerability is fixed in firmware version 0.18.15r; devices on earlier firmware remain fully exposed to unauthenticated config/firmware upload from the adjacent network. ↗

CVSS provenance

nvd v3.1 9.8 CRITICAL CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

vulncheck 8.8 HIGH

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.

CWE-434