CVE-2022-48625: Yealink's Config Encrypt Tool Add RSA Security Flaw

Yealink, a well-known provider of various VoIP (Voice over IP) solutions, has discovered a security vulnerability in their Config Encrypt Tool Add RSA feature in versions prior to 1.2. The tool encrypts configuration files, which typically contain important details such as account credentials, server addresses, and other sensitive information. This vulnerability, identified as CVE-2022-48625, allows an attacker to potentially decrypt the encrypted data using a built-in RSA key pair. This post will dive into the details of the exploit, provide code snippets, and link to original references for more information.

Vulnerability Details

The Config Encrypt Tool from Yealink is intended to add an additional layer of security by encrypting sensitive configuration files. This is to ensure that even if a malicious party gains access to the configuration files, the information remains unreadable due to encryption. The flaw in the specific versions mentioned is that the encryption routine utilizes a built-in RSA key pair, which is present in all installations. This makes it easy for an attacker with knowledge of the corresponding RSA private key to decrypt any encrypted data easily.

Exploit

An attacker who has access to the private key of the built-in RSA key pair can use that private key to decrypt the data encrypted with the corresponding public key during the encryption process. Here is a code snippet in Python demonstrating how this can be done (assuming the attacker has obtained the private key):

from Crypto.PublicKey import RSA
from Crypto.Cipher import PKCS1_v1_5
import base64

# Load the obtained private key
private_key_data = open('private_key.pem', 'r').read()
rsa_private_key = RSA.importKey(private_key_data)

# Initialize the decryptor
decryptor = PKCS1_v1_5.new(rsa_private_key)

# Read and decrypt the data
encrypted_data = base64.b64decode('...')
decrypted_data = decryptor.decrypt(encrypted_data, None)

# Print decrypted data
print(decrypted_data)

This simple exploit shows that, as long as an attacker has access to the built-in RSA private key, they can decrypt any data encrypted by Yealink's Config Encrypt Tool in affected versions quite easily.

Mitigation

To mitigate this security risk, users of the Yealink Config Encrypt Tool Add RSA feature should immediately upgrade to version 1.2 or newer, as this version no longer relies on the vulnerable built-in RSA key pair for encryption. Also, users should ensure that all previously encrypted data is properly decrypted and subsequently re-encrypted using a secure version of the software.

Original References

The issue was originally disclosed in a security advisory issued by Yealink themselves. Additionally, the complete CVE record for this vulnerability can be found on the MITRE website.

Conclusion

The CVE-2022-48625 vulnerability in Yealink's Config Encrypt Tool Add RSA feature poses a significant risk to users, as it potentially allows an attacker to decrypt sensitive configuration data. By promptly upgrading to the secure version (1.2 or newer) and re-encrypting any previously encrypted data, users can prevent exploitation of this vulnerability and protect their sensitive information.

Timeline

Published on: 02/20/2024 00:15:14 UTC
Last modified on: 08/29/2024 20:35:08 UTC