# Hacking Millions of Modems (and Investigating Who Hacked My Modem)

Cox Business API had an intermittent auth bypass allowing unauthenticated access to 700+ endpoints, enabling device takeover and PII leak for millions of modems.

- Payout: Research
- Severity: critical
- Program: Cox
- Credited: Sam Curry
- Disclosed: 2024-06-03
- Write-up quality: 9/10
- Original: https://samcurry.net/hacking-millions-of-modems
- Library page: https://bugbountylibrary.com/r/blog%3Asamcurry-net-hacking-millions-of-modems
- Tags: domain:api domain:web impact:data-leak impact:pii-leak impact:rce kind:research platform:research sev:critical technique:recon technique:source-review vuln:access-control vuln:auth-bypass vuln:info-disclosure

**Target:** Cox Business web portal and backend REST API
**Root cause:** The API intermittently failed to enforce authorization, allowing unauthenticated requests to succeed on retry. Additionally, a static asset routing rule was bypassed with a trailing %2f, exposing Swagger docs.
**Steps:**
1. Discover /api/cbma/ reverse proxy and Swagger UI at /api/cbma/userauthorization/swagger-ui/index.html
2. Bypass static asset routing by appending %2f to .js URLs to load Swagger docs
3. Enumerate 700+ API endpoints from Swagger; send unauthenticated requests with headers `Clientid: cbmauser`, `Apikey: 5d228662-aaa1-4a18-be1c-fb84db78cf13`, `Cb_session: unauthenticateduser`, `Authorization: Bearer undefined`
4. Replay requests until 200 OK to bypass intermittent auth errors
5. Use `/api/cbma/profile/services/profile/profilesearch/{name}` to search customers and get profileGuid
6. Use `/api/cbma/accountequipment/services/accountequipment/v1/equipments/{accountId}` to retrieve MAC addresses
7. Use `/api/cbma/accountequipment/services/accountequipment/ipAddress?macAddress={mac}` to get device IP
8. Extract AES key/IV from JavaScript `encryptWithSaltandPadding` function; encrypt arbitrary payload with MAC address
9. Send POST to `/api/cbma/accountequipment/services/accountequipment/gatewaydevice/wifisettings` with `encryptedValue` to change SSID
**How found:** After noticing traffic replay from a compromised modem, the author investigated ISP support tools. He analyzed the Cox Business portal JavaScript, discovered the /api/cbma/ reverse proxy, bypassed static asset routing with %2f to access Swagger docs, and found intermittent auth bypass by replaying requests.
**Exploitation:** Attacker searches for a customer by name to get profileGuid, retrieves account ID and equipment MAC addresses, then crafts encryptedValue using leaked AES key to send device configuration commands, achieving remote code execution and full device takeover.
**Escalation:** Chained customer search, equipment enumeration, and encrypted command execution to compromise any Cox modem and access PII.
**Insight:** When testing APIs behind reverse proxies, try appending URL-encoded slashes (%2f) to static file extensions to bypass routing rules and access protected Swagger docs. Also, intermittent auth failures may indicate a race condition or state issue that can be bypassed by replaying requests.