Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2017-6094: Genexis GAPS lets attacker steal other users' settings

CVE-2017-6094 · published 8 years ago

Summary

The central GAPS system that sends configuration data to customer devices can be tricked into accepting forged identifiers. By creating a fake identifier, an attacker can retrieve another subscriber’s configuration, including sensitive login details for services like VoIP. Update GAPS to the latest version or apply the vendor’s patch to stop the forgery.

What to do

Update genexis gaps to version 7.2 or later.

Affected software

Vendor	Product	Affected versions
genexis	gaps	< 7.2 `cpe:2.3:a:genexis:gaps::::::::`

Original advisory text

CPEs used by subscribers on the access network receive their individual configuration settings from a central GAPS instance. A CPE identifies itself by the MAC address of its WAN interface and a certain "chk" value (48bit) derived from the MAC. The algorithm used to compute the "chk" was disclosed by reverse engineering the CPE's firmware. As a result, it is possible to forge valid "chk" values for any given MAC address and therefore receive the configuration settings of other subscribers' CPEs. The configuration settings often contain sensitive values, for example credentials (username/password) for VoIP services. This issue affects Genexis B.V. GAPS up to 7.2.

References

http://seclists.org/fulldisclosure/2017/Dec/62 Exploit Mailing List Mitigation Third Party Advisory

Fix within

Internet-facing 3 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker full control (estimated)

Severity

9.8 Critical

Exploitation

1% chance of attack within 30 days

Type

CWE-200Information Exposure

Timeline

Published20 Dec 2017

Updated4 Nov 2026

First seen29 Sep 2026

Sources

CVE-2017-6094 · NVD

Track software like this

Free during beta