Message-ID: <6394b08a-6e3d-48aa-b7af-36d9ee8c5fee@cloudaware.eu>
Date: Tue, 20 Feb 2024 13:50:33 +0100
From: "Jeroen J.A.W. Hermans via Fulldisclosure" <fulldisclosure@...lists.org>
To: fulldisclosure@...lists.org
Subject: [FD] CVE-2024-24681: Insecure AES key in Yealink Configuration
 Encrypt Tool

CloudAware Security Advisory

CVE-2024-24681: Insecure AES key in Yealink Configuration Encrypt Tool


========================================================================
Summary
========================================================================
A single, vendorwide, hardcoded AES key in the configuration tool used to
encrypt provisioning documents was leaked leading to a compromise of
confidentiality of provisioning documents.

========================================================================
Product
========================================================================
* Yealink Configuration Encrypt Tool (AES version)
* Yealink Configuration Encrypt Tool (RSA version <v1.2)

========================================================================
Detailed description
========================================================================
The Yealink Configuration Encrypt Tool facilites provisioning and 
configuration mangement
of Yealink products, such as VoIP phones. The tool created AES encrypted 
provisioning
documents, containing configuration directives such as
username=user1
passwword=passw0rd!
serverhost=sip.host.com
callerid=+19051231212
The files created by this tool are then transferred to the Yealink 
equipment. The equipment
decrypts the files and uses them to configure itself.
This process needs to be secure. So these files are encrypted.
The decryption is done by a static, hardcoded, key that is identical 
across all installs and
customers. After decryption of this file by the hardcoded AES key 
confidential information,
such as user passwords are visible in plain text.
This implies that knowledge of this hardcoded key allows for the 
disclosure of sensitive
information from the configuration files, or that files with different 
information can be
introduced and are axiomatically trusted by the phone.
As this key is static - this includes historic files from any customer 
that used this tool.
The vendor has fixed this in version 1.2 of the Configuration Encrypt Tool.

========================================================================
Solution
========================================================================
1) Upgrade Yealink Configuration Encrypt Tool to version 1.2
2) Evaluate the impact of the disclosure of any configurations rolled 
out with
prior versions of this tool (including, specifically, the leaking of 
passwords)

========================================================================
Mitigation
========================================================================
1) If an upgrade is not an option - as `anyone' can create valid 
configuration
files; ensure that affected equipment is unable to reach provisioning 
servers.
2) Evaluate the impact of the disclosure of any configurations rolled 
out prior
to these mitigation steps

========================================================================
Weblinks
========================================================================
https://github.com/gitaware/CVE/tree/main/CVE-2024-24681

========================================================================
History
========================================================================
early 2020, release of Configuration Encrypt Tool v1 containing RSA 
encryption method
juli 2022, Yealink informed “old” AES key still present and working in tool
2023, new version of Configuration Encrypt Tool v1.2 without a hardcoded 
AES
encryptionkey

Download attachment "OpenPGP_0x52DD23305307A27C.asc" of type "application/pgp-keys" (670 bytes)

Download attachment "OpenPGP_signature.asc" of type "application/pgp-signature" (237 bytes)

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: https://seclists.org/fulldisclosure/

Powered by blists - more mailing lists