Followup regarding CVE-2023-31728 and the RUT-240

This page is a follow-up to the following material previously published by Exotic Silicon:

=> Review and tutorial of using the RUT-240 in bridge mode | Details of a vulnerability found by Exotic Silicon during the preparation of the above article

Fixed

Shortly after we discovered the issue, we made contact with the security team at Teltonika and provided detailed instructions to reproduce it.

They confirmed the bug, and a few days later it was fixed in firmware version 07.04.2.

Tested

We promptly downloaded the new firmware and installed it on one of our RUT-240 devices for testing.

The bug has indeed been fixed. After removing the extra firewall rules that we had created as a work-around to mitigate it with the previous version of the firmware, we re-tested the same method of remote access but the connection was correctly rejected.

Stable

The new firmware was in use and running without issues on our RUT-240 routers, which are configured in bridge mode, for 28 days starting from 20230421.

At this point we updated them to the newly released firmware 07.04.3, which we are still evaluating as of the time of writing on 20230519.

Curiosity

The first time we tried upgrading each router from firmware 07.04.1 to 07.04.2 whilst preserving the existing configuration, the upgrade appeared to complete correctly.

However, packets from the connected device were not routed out to the internet. Since nothing was obviously mis-configured, we decided to reset the device to factory settings, (whilst keeping the most recent firmware version 07.04.2). After the factory reset and subsequent re-configuration as described in the original article, the RUT-240 worked as expected and correctly routed data from the connected device to the cellular interface.

This happened exactly once with each router we upgraded, but after performing the factory reset we have not been able to reproduce the issue again, (despite testing various combinations of old firmwares).

=> Home page of the Exotic Silicon gemini capsule. | Your use of this gemini capsule is subject to the terms and conditions of use.

Copyright 2016, 2017, 2018, 2019, 2020, 2021, 2022, 2023 Exotic Silicon. All rights reserved.