Cisco, Meraki, and Aruba provide no less than 70% of business wireless access points, which places all of those companies at risk. It is not yet known precisely how many appliances are vulnerable and have the BleedingBit vulnerabilities, even though Armis Labs doubts millions of appliances might be affected.
If theBleedingBit vulnerabilities are abused, attackers would be able to take complete control of the access points without any requirement for verification. The access points could be deactivated, data could be interrupted, malware fitted, or the attackers might use the vulnerabilities to gain access to company systems served by the access points and access any appliance in the neighborhood of the AP.
TwoBleedingBit vulnerabilities have been found. CVE-2018-16986 lets memory corruption in the BLE stack, through which complete control of the AP might be gained. To abuse the vulnerability, an attacker would need to be within the limit of the AP and BLEwould need to be turned on. No knowledge of the appliance would be needed and there are no other preconditions to abuse the vulnerability.
An attacker would need to send particularly created packets to the AP containing code which is run in the next phase of the attack. The second phase involves sending an overflow packet to trigger a vital memory overflow which lets the attacker run the earlier sent code.
The vulnerability
The second of the BleedingBit vulnerabilities – CVE-2018-7080 – is existing in the over-the-air firmware download (OAD) feature of Texas instruments’ chips utilized in ArubaSeries 300 Wi-Fi Access Points. The vulnerability is a development backdoor tool that has not been detached. If abused, the vulnerability would let a new and completely different variety of firmware to be installed, letting the attacker gain complete control of the appliance.
Armis Labs says that abuse of the BleedingBit vulnerabilities would not be spotted by usual AV solutions and would be unlikely to raise any red flags. The attacker might move laterally between network parts, interrupt traffic, install malware, interfere with operating systems, and hijack a wide variety of appliances unnoticed.
Cisco has already repaired its affected appliances, and Meraki has published help on how users can make modifications to BLE settings to avoid misuse of the vulnerabilities. Misuse of CVE-2018-7080 can be obstructed by deactivating OAD functionality. Texas Instruments has now rectified the fault in BLE-STACK v2.2.2.