The backup restore function on the Verizon MiFi 6620L, version 4.5, allows a user to modify critical system files on the device such as the 'root' user's crontab file.
The backup restore function allows a user to upload previously saved configuration files to restore the device to a known state. The backup file is a base64-encoded, encrypted zip file. It can be encrypted and decrypted using the 'nvtl_encrypt' utility on the device. The encryption mechanism is not unique to the device, and configurations can be shared across devices.
An authenticated user can download a copy of their device's configuration file through the web interface, decode and decrypt it, then modify the zip to include a 'root' crontab file. After re-encrypting and re-encoding, the user uploads the modified configuration through the restore function. In this way the user can execute commands on the device as root through the crontab function.
The backup restore function on the Verizon MiFi 6620L, version 4.5, lets a user modify critical system files on the device, including the root user crontab file. Advisory L9-46-492 lists the category as escalated privileges and the impact as Medium.
Yes. The advisory describes an authenticated user downloading a copy of their own device configuration through the web interface, modifying it, and uploading it again through the restore function. The privilege gained is root, so this is an escalation from a normal device user rather than an unauthenticated attack.
The backup file is a base64 encoded, encrypted zip archive. It can be encrypted and decrypted with the nvtl_encrypt utility present on the device itself. The advisory notes the encryption mechanism is not unique to a single unit, so configurations can be shared across devices.
The MiFi backup restore flaw gives command execution as root. By inserting a root crontab file into the modified backup archive and restoring it through the web interface, a user gets the device to run commands as root. The advisory covers Verizon MiFi 6620L version 4.5.
Yes. A separate ELTON advisory, L9-46-493, covers an unauthenticated file upload on the same device where the CSRF token is not validated. That advisory describes chaining the two into a full compromise of the MiFi 6620L, ending in a reverse shell with root access.