CVE-2020-7982: OpenWrt LEDE RCE Vulnerability

CVE-2020-7982 Overview

A critical vulnerability was discovered in OpenWrt's fork of the opkg package manager that affects versions 18.06.0 through 18.06.6, 19.07.0, and LEDE 17.01.0 through 17.01.7. The vulnerability stems from a bug that prevents correct parsing of embedded checksums in the signed repository index. This flaw allows a man-in-the-middle attacker to inject arbitrary package payloads that are installed on the target device without any verification, effectively bypassing the package signing mechanism entirely.

Critical Impact

Attackers positioned in a man-in-the-middle scenario can inject malicious packages during firmware updates or package installations, achieving arbitrary code execution on vulnerable OpenWrt/LEDE devices including routers, access points, and IoT gateways.

Affected Products

• OpenWrt versions 18.06.0 to 18.06.6
• OpenWrt version 19.07.0
• LEDE versions 17.01.0 to 17.01.7

Discovery Timeline

• 2020-01-25 - opkg package manager patched
• 2020-01-31 - OpenWrt releases security advisory
• 2020-03-16 - CVE-2020-7982 published to NVD
• 2024-11-21 - Last updated in NVD database

Technical Details for CVE-2020-7982

Vulnerability Analysis

This vulnerability (CWE-345: Insufficient Verification of Data Authenticity) exists due to improper parsing logic in the opkg package manager when processing checksums from signed package repository indexes. While OpenWrt implements cryptographic signing for its package repositories, the opkg fork contained a parsing bug that caused it to incorrectly handle embedded SHA256 checksums within the signed Packages.gz index file.

The issue lies in how opkg parsed lines containing both package metadata and checksum information. When a checksum field contained leading whitespace or specific formatting, the parser would fail to correctly extract and verify the checksum value. This meant that even though the repository index was cryptographically signed and authentic, the individual package checksums were not being properly validated against downloaded package files.

Root Cause

The root cause is a parsing error in the opkg package manager's checksum extraction routine. The code responsible for reading the SHA256sum field from signed package indexes failed to properly handle certain valid formatting variations. When the checksum field was present but improperly parsed, opkg would proceed with package installation without actually verifying the package integrity against the expected hash value. This effectively nullified the checksum verification security control.

Attack Vector

The attack requires a network-based man-in-the-middle position between the victim OpenWrt device and the package repository servers. An attacker who can intercept and modify network traffic can exploit this vulnerability through the following mechanism:

1. The attacker intercepts the legitimate Packages.gz signed index file, which passes signature verification
2. When the target device requests a specific package file (.ipk), the attacker substitutes a malicious package
3. Due to the checksum parsing bug, opkg fails to detect that the downloaded package does not match the expected checksum
4. The malicious package is installed with root privileges on the OpenWrt device

This attack is particularly dangerous because it targets the software update mechanism itself. Routers and network devices running OpenWrt are high-value targets as they control network traffic and often have access to all connected devices. Successful exploitation grants the attacker persistent root-level access to the compromised device.

Detection Methods for CVE-2020-7982

Indicators of Compromise

• Unexpected packages installed on OpenWrt devices that were not explicitly requested by administrators
• Modified system configuration files or startup scripts that persist after device reboots
• Unusual outbound network connections from the router to unknown IP addresses or command-and-control infrastructure
• Unexpected processes running on the device, particularly those with network access or persistence mechanisms

Detection Strategies

• Monitor network traffic from OpenWrt devices for connections to non-standard package repositories or suspicious download patterns
• Implement network segmentation to detect potential MITM attacks targeting router update traffic
• Compare installed package lists and checksums against known-good baselines from official OpenWrt releases
• Review system logs for opkg installation events that coincide with network anomalies

Monitoring Recommendations

• Deploy network intrusion detection systems (IDS) to monitor for traffic interception attempts on router management networks
• Establish out-of-band management channels for critical network infrastructure to reduce MITM attack surface
• Regularly audit OpenWrt device configurations and installed packages against documented change management records

How to Mitigate CVE-2020-7982

Immediate Actions Required

• Upgrade all OpenWrt devices to version 18.06.7, 19.07.1, or later immediately
• Upgrade LEDE devices to a supported OpenWrt release as LEDE has been merged into OpenWrt
• Verify the integrity of currently installed packages by comparing against official repository checksums
• Consider re-flashing devices with a clean firmware image if compromise is suspected

Patch Information

OpenWrt addressed this vulnerability in opkg commits prior to 2020-01-25 and released patched firmware versions. The fix corrects the checksum parsing logic to properly extract and verify SHA256 checksums from the signed package index. Users should update to OpenWrt 18.06.7+ or 19.07.1+ which contain the corrected opkg package manager. Detailed information is available in the OpenWRT Security Advisory and the GitHub OpenWRT Commits.

Workarounds

• Avoid performing package updates over untrusted networks where MITM attacks are possible
• Use VPN connections to trusted networks when performing firmware or package updates on OpenWrt devices
• Manually verify package checksums by downloading packages through a trusted system and comparing against official SHA256 hashes before installation
• Disable automatic package updates until devices can be upgraded to patched firmware versions

# Verify current OpenWrt version
cat /etc/openwrt_release

# Check for available updates (only on trusted networks)
opkg update
opkg list-upgradable

# Manual checksum verification example
sha256sum /tmp/package.ipk
# Compare output against official repository checksum