Secret Backdoors Found in German-made Auerswald VoIP System

Multiple backdoors have been discovered during a penetration
test in the firmware of a widely used voice over Internet Protocol
(VoIP) appliance from Auerswald, a German telecommunications
hardware manufacturer, that could be abused to gain full
administrative access to the devices.

“Two backdoor passwords were found in the firmware of the
COMpact 5500R PBX^[1],” researchers from
RedTeam Pentesting said in a technical^[2]
analysis^[3]
published Monday. “One backdoor password is for the secret user
‘Schandelah‘, the other can be used for the
highest-privileged user ‘admin.’ No way was discovered to
disable these backdoors.”

The vulnerability has been assigned the identifier CVE-2021-40859^[4]
and carries a critical severity rating of 9.8. Following
responsible disclosure on September 10, Auerswald addressed the
problem in a firmware update (version 8.2B) released in November
2021. “Firmware Update 8.2B contains important security updates
that you should definitely apply, even if you don’t need the
advanced features,” the company said^[5]
in a post without directly referencing the issue.

PBX^[6], short for private
branch exchange, is a switching system that serves a private
organization. It’s used to establish and control telephone calls
between telecommunication endpoints, including customary telephone
sets, destinations on the public switched telephone network (PSTN),
and devices or services on VoIP networks.

RedTeam Pentesting said it uncovered the backdoor after it began
to take a closer look into a service Auerswald provides in the
event a customer were to lose access to their administrator
account, in which case the password associated with a privileged
account can be reset by reaching out to the manufacturer.

Specifically, the researchers found that the devices are
configured to check for a hard-coded username “Schandelah” besides
“sub-admin,” the account that’s necessary to manage the device,
according to the official documentation^[7]. “It turns out that
Schandelah is the name of a tiny village in northern Germany where
Auerswald produces their devices,” the researchers said.

Follow-on investigation by the German pen-testing firm revealed
that “the corresponding password for this username is derived by
concatenating the PBX’s serial number, the string ‘r2d2,’ and the
current date [in the format ‘DD.MM.YYYY’], hashing it with the
MD5 hash^[8] algorithm and taking the
first seven lower-case hex chars of the result.”

Put simply, all an attacker needs to generate the password for
the username “Schandelah” is to obtain the serial number of the PBX
— a piece of information that can be trivially retrieved using an
unauthenticated endpoint (“https://192.168.1[.]2/about_state”),
enabling the bad actor to gain access to a web interface that
allows for resetting the administrator password.

On top of that, the researchers said they identified a second
backdoor when the administrative username “admin” is passed, for
which a fallback password is programmatically derived using the
aforementioned algorithm, only difference being that a two-letter
country code is suffixed to the concatenated string prior to
creating the MD5 hash. The alternative password, as in the previous
case, provides full-privileged access to the PBX without having to
change the password in the first place.

“Using the backdoor, attackers are granted access to the PBX
with the highest privileges, enabling them to completely compromise
the device,” the researchers said. “The backdoor passwords are not
documented. They secretly coexist with a documented password
recovery function supported by the vendor.”