← Advisories

USR IOT 4G LTE Industrial Cellular VPN Router 1.0.36 Remote Root Backdoor

Critical
Advisory ID
ZSL-2022-5705
Release Date
20 April 2022
Vendor
Jinan USR IOT Technology Limited - https://www.pusr.com
Affected Version
1.0.36 (USR-G800V2, USR-G806, USR-G807, USR-G808), 1.2.7 (USR-LG220-L)
Tested On
GNU/Linux 3.10.14 (mips), OpenWrt/Linaro GCC 4.8-2014.04, Ralink SoC MT7628 PCIe RC mode, BusyBox v1.22.1, uhttpd, Lua
Summary

USR-G806 is a industrial 4G wireless LTE router which provides a solution for users to connect own device to 4G network via WiFi interface or Ethernet interface. USR-G806 adopts high performance embedded CPU which can support 580MHz working frequency and can be widely used in Smart Grid, Smart Home, public bus and Vending machine for data transmission at high speed. USR-G806 supports various functions such as APN card, VPN, WIFIDOG, flow control and has many advantages including high reliability, simple operation, reasonable price. USR-G806 supports WAN interface, LAN interface, WLAN interface, 4G interface. USR-G806 provides various networking mode to help user establish own network.

Description

The USR IOT industrial router is vulnerable to hard-coded credentials within its Linux distribution image. These sets of credentials are never exposed to the end-user and cannot be changed through any normal operation of the device. The 'usr' account with password 'www.usr.cn' has the highest privileges on the device. The password is also the default WLAN password.

Proof of Concept
Disclosure Timeline
10.04.2022Vulnerability discovered.
14.04.2022Vendor contacted.
19.04.2022No response from the vendor.
20.04.2022Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
20.04.2022Initial release
03.05.2022Added reference [1], [2] and [3]
13.05.2022Added reference [4]
29.05.2022Added reference [5] and [6]