#VU24232 Buffer overflow in F@st 3890 and F@st 3686 - CVE-2019-19494

Vulnerability identifier: #VU24232

Vulnerability risk: High

CVSSv4.0: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:A/U:Amber]

CVE-ID: CVE-2019-19494

CWE-ID: CWE-119

Exploitation vector: Network

Exploit availability: Yes

Vulnerable software:
F@st 3890
Hardware solutions / Routers for home users
F@st 3686
Hardware solutions / Routers for home users

Vendor: Sagemcom

Description

The vulnerability allows a remote attacker to execute arbitrary code on the target system.

The vulnerability exists due to a boundary error when processing packets sent to spectrum analyzer build-in feature. By default the affected router accepts requests from local network only, however an attacker can craft a specially crafted webpage and use victim's browser to deliver malicious request to the affected router, e.g. via websockets and a specially crafted JSON payload.

Successful exploitation of this vulnerability may result in complete compromise of the affected router.

Note, this vulnerability was dubbed Cable Haunt by the researcher.

Mitigation
Install updates from vendor's website.

Vulnerable software versions

F@st 3890: before 05.76.6.3f

F@st 3686: before 3.428.0

---

External links
https://cablehaunt.com
https://github.com/Lyrebirds/Cable-Haunt-Report/releases/download/2.4/report.pdf
https://github.com/Lyrebirds/Fast8690-exploit
https://www.broadcom.com

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, a fully functional exploit for this vulnerability is available.