Attack Chain

1. Attacker identifies an Across DR-810 router exposed on the network.
2. Attacker crafts an HTTP GET request targeting the /rom-0 endpoint.
3. The router responds with the rom-0 backup file without requiring authentication.
4. Attacker downloads the rom-0 backup file.
5. Attacker decompresses the downloaded rom-0 file, which is likely compressed to reduce size.
6. The attacker parses the decompressed file to extract sensitive information such as router passwords.
7. Attacker uses the extracted router passwords to gain administrative access to the router’s web interface.

Impact

Successful exploitation of this vulnerability allows attackers to retrieve sensitive information, including router passwords and configuration data. This can lead to complete compromise of the affected router. An attacker can then modify router settings, intercept network traffic, or potentially use the compromised router as a pivot point to access other systems on the network. If the router passwords are reused across multiple systems, the impact could extend beyond the compromised router, affecting other devices and services.

Recommendation

• Monitor web server logs for requests to the /rom-0 endpoint on Across DR-810 routers to detect potential exploitation attempts using the provided Sigma rule.
• Inspect network traffic for unusual downloads from Across DR-810 routers, focusing on responses from the /rom-0 endpoint.
• Block access to the /rom-0 endpoint on Across DR-810 routers via firewall rules to prevent unauthorized access.
• Review the provided reference URLs for additional context and potential mitigation strategies.