Unauthenticated Telnet Access in Calix GigaCenter ONT (CVE-2020-7066)

Critical Vulnerability Information Vulnerability Overview Name: Unauthenticated Telnet Access in Calix GigaCenter ONT Code Name: #41 Status: Fixed Public Disclosure Date: Sep 9, 2020 Affected Product: Calix GigaCenter Vendor: Calix Affected Versions: 844E, 844GC, 844GE v3.54GE Fixed Version: P12.2.1.4 patch available to authorized users Vulnerability Type: Exposure of sensitive services Remote Exploitable: Yes CVSS v3.0 Vector Score: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N CVSS v3.0 Base Score: 6.7 CVE ID: CVE-2020-7066 Vulnerability Description Calix GigaCenter ONT (844E, 844GC, and 844GE) contains a vulnerability that allows unauthenticated Telnet access. When the Calix GigaCenter is configured in the Bootstrap configuration to enable Telnet service, the Telnet service becomes accessible via the root user. As a result of this issue, the GigaCenter system exposes unauthorized external network access and presents an additional external attack surface. Exploitation Evidence Unauthorized Telnet access via console was identified in the GigaCenter Bootloader SVC process. IP address and port (23) for Telnet access were provided. Command-line interface access to two Telnet services via unauthorized Telnet access was demonstrated. Security Policy CVE-2020-7066 was published on December 22, 2020. System Information Calix GigaCenter TAT NAME: 844E, 844GC, and 844GE Firmware Version: 3.54GE (corresponding patch: P12.2.1.4) References Vendor: https://www.calix.com/ Security: https://www.calix.com/security.html Mitigation The vulnerability was discovered on 172.17.7.27 and is accessible to unauthorized users. It is recommended to contact your BSP to obtain the patch, as these devices have not been widely distributed. Acknowledgments This vulnerability was discovered by hacktivis, an independent security researcher. Timeline July 16, 2020: Vulnerability discovered July 21, 2020: Contacted vendor August 1, 2020: Vulnerability patched September 5, 2020: Vulnerability confirmed September 9, 2020: Vulnerability disclosed publicly

Goal Reached Thanks to every supporter — we hit 100%!

Unauthenticated Telnet Access in Calix GigaCenter ONT (CVE-2020-7066)