Sign-up

ID

VAR-201309-0455


CVE

CVE-2013-5620


TITLE

Multiple vulnerabilities in multiple Zoom Telephonics devices

Trust: 0.6

sources: CNVD: CNVD-2013-09590

DESCRIPTION

Rejected reason: DO NOT USE THIS CANDIDATE NUMBER. ConsultIDs: none. Reason: A public posting on 20130831 referenced this ID for a specific issue, but that issue had not been assigned this ID by any CNA. Notes: The posting will later have IDs assigned in accordance with CVE content decisions. Zoom X4 and X5 are ADSL router devices. Multiple Zoom Telephonics devices have information leaks, verification bypasses and SQL injection vulnerabilities that allow remote attackers to exploit these vulnerabilities to gain unauthorized access, obtain sensitive information, and modify and access device data. Multiple Zoom Telephonics devices are prone to an information-disclosure vulnerability, multiple authentication bypass vulnerabilities and an SQL-injection vulnerability. They were first reported on June 28th, 2013 and partial disclosure was made on July 9, 2013. ---------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------- Directory Traversal/Unauthenticated access to administrative panels CVSS Base Score 9.7 Impact Subscore 9.5 Temporal Score: 8.3 (AV:N/AC:L/Au:N/C:P/I:C/A:C/E:F/RL:W/RC:UR/CDP:H/TD:H/CR:ND/IR:ND/AR:ND) CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVE-2013-5622 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.2 CVE-2013-5627 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X CVE-2013-5624 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.0.X By simply placing the following two URLs into a web browser, a vulnerability will all models and firmware versions allow for bypass of administrative credential challenge. All models and firmware versions can access these pages with no authentication. An un-authenticated user can preform almost all administrative tasks once the authentication is bypassed. http://<IP>/hag/pages/toc.htm (--Menu Banner) http://<IP>/hag/pages/toolbox.htm (-Advanced Options Menu) ---------------------------------------------------------------------------------------------------------------- Improper handling of unexpected characters/data CVSS Base Score 8.3 Impact Subscore 8.5 Temporal Score: 6.7 (AV:N/AC:M/Au:N/C:P/I:P/A:C/E:POC/RL:W/RC:UR) CWE-241: Improper Handling of Unexpected Data Type CVE-2013-5623 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.2 CVE-2013-5628 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X CVE-2013-5631 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.0.X CVE-2013-5632 - Zoom ADSL Bridge Modem Model 5715; all firmware versions CVE-2013-5633 - Zoom USB ADSL Modem Model 5510B; all firmware versions When an unexpected/illegal character is added to the end of any URL which calls a value, such as http://<IP>/MainPage?id=25' the browser will immediately redirect the browser to the "System Status" page without authentication, where links to each interface (i.e. eth-0,usb-0,etc) is both selectable whose properties can be edited. ---------------------------------------------------------------------------------------------------------------- Plain text storage of ISP/PPPoe usernames/passwords CVSS Base Score 6.8 Impact Subscore 6.4 Temporal Score: 8.6 (AV:N/AC:M/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR) CWE-311: Missing Encryption of Sensitive Data CVE-2013-5620 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.2 CVE-2013-5626 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X CVE-2013-5629 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.0.X The following command will display the ISP usernames and passwords. (The print value may vary slightly based on firmware.) Proof of Concept curl -s http://<IP>/MainPage?id=25 |egrep -i 'MacWanPasswd'|awk '{ print $8 }' value="wanpasswd1" ('or similar') curl -s http://<IP>/MainPage?id=25 |egrep -i 'MacWanUsrName'|awk '{ print $21 }' value="user@usersisp.net" ('or similar') ---------------------------------------------------------------------------------------------------------------- Unauthenticated direct execution of administrative tasks CVSS Base Score 10.0 Impact Subscore 10.0 Temporal Score: 8.6 (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:W/RC:UR/CDP:H/TD:H/CR:ND/IR:ND/AR:ND) CWE-285: Improper Authorization CVE-2013-5621 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X CVE-2013-5625 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X CVE-2013-5630 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X Administrative authentication can be bypassed and commands directly executed with specially crafted commands. Proofs of Concept - Create New Acct Admin or Intermediate - (all PW and admin names are 'or similar') http://<IP>/hag/emweb/PopOutUserAdd.htm?id=70&user_id="newintermediateaccount"&priv=v2&pass1="123456"&pass2="123456"&cmdSubmit=Save+Changes Clear Logs http://<IP>/Action?id=76&cmdClear+Log=Clear+Log ---------------------------------------------------------------------------------------------------------------- Fixes/Patches: There are no known patches or fixes for these vulnerabilities at this time. Workaround: It is advised to turn off all remote administrative access to the router. This workaround however, will not prevent local attacks. ---------------------------------------------------------------------------------------------------------------- External Links http://www.osvdb.org/show/osvdb/95071 http://xforce.iss.net/xforce/xfdb/85612 http://www.idappcom.com/db/?7819 Vendor Links http://www.zoomtel.com/products/5715.html http://www.zoomtel.com/graphics/datasheets/adsl/USB_3104_5510B.pdf http://www.zoomtel.com/products/adsl_overview.html http://www.zoomtel.com/products/5760.html http://www.zoomtel.com/products/5751.html http://www.zoomtel.com/products/5754.html Discovered - 06-28-2013 Updated - 09/01/2013 Research Contact - K Lovett Affiliation - QuattroSG

Trust: 1.8

sources: NVD: CVE-2013-5620 // CNVD: CNVD-2013-09590 // BID: 61044 // PACKETSTORM: 123053

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2013-09590

AFFECTED PRODUCTS

vendor:zoom telephonicsmodel:adsl modem and routerscope:eqversion:x5

Trust: 0.6

vendor:zoom telephonicsmodel:adsl modem and routerscope:eqversion:x4

Trust: 0.6

sources: CNVD: CNVD-2013-09590

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD: CNVD-2013-09590
value: HIGH

Trust: 0.6

CNVD: CNVD-2013-09590
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

sources: CNVD: CNVD-2013-09590

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201307-225

TYPE

other

Trust: 0.6

sources: CNNVD: CNNVD-201307-225

EXTERNAL IDS

db:NVDid:CVE-2013-5620

Trust: 2.0

db:BIDid:61044

Trust: 1.5

db:EXPLOIT-DBid:26736

Trust: 0.6

db:CNVDid:CNVD-2013-09590

Trust: 0.6

db:CNNVDid:CNNVD-201307-225

Trust: 0.6

db:XFid:85612

Trust: 0.1

db:OSVDBid:95071

Trust: 0.1

db:PACKETSTORMid:123053

Trust: 0.1

sources: CNVD: CNVD-2013-09590 // BID: 61044 // PACKETSTORM: 123053 // CNNVD: CNNVD-201307-225 // NVD: CVE-2013-5620

REFERENCES

url:http://www.exploit-db.com/exploits/26736/

Trust: 0.6

url:http://www.securityfocus.com/bid/61044

Trust: 0.6

url:https://nvd.nist.gov/vuln/detail/cve-2013-5623

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5620

Trust: 0.1

url:http://www.zoomtel.com/products/5754.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5627

Trust: 0.1

url:http://xforce.iss.net/xforce/xfdb/85612

Trust: 0.1

url:http://www.zoomtel.com/products/5715.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5625

Trust: 0.1

url:http://<ip>/hag/pages/toc.htm

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5630

Trust: 0.1

url:http://www.zoomtel.com/products/5760.html

Trust: 0.1

url:http://<ip>/mainpage?id=25'

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5626

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5629

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5621

Trust: 0.1

url:http://www.osvdb.org/show/osvdb/95071

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5628

Trust: 0.1

url:http://<ip>/action?id=76&cmdclear+log=clear+log

Trust: 0.1

url:http://www.zoomtel.com/products/adsl_overview.html

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5632

Trust: 0.1

url:http://www.zoomtel.com/graphics/datasheets/adsl/usb_3104_5510b.pdf

Trust: 0.1

url:http://<ip>/hag/pages/toolbox.htm

Trust: 0.1

url:http://www.zoomtel.com/products/5751.html

Trust: 0.1

url:http://<ip>/mainpage?id=25

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5631

Trust: 0.1

url:http://www.idappcom.com/db/?7819

Trust: 0.1

url:http://<ip>/hag/emweb/popoutuseradd.htm?id=70&user_id="newintermediateaccount"&priv=v2&pass1="123456"&pass2="123456"&cmdsubmit=save+changes

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5622

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5633

Trust: 0.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-5624

Trust: 0.1

sources: CNVD: CNVD-2013-09590 // PACKETSTORM: 123053 // CNNVD: CNNVD-201307-225

CREDITS

Kyle Lovett

Trust: 1.0

sources: BID: 61044 // PACKETSTORM: 123053 // CNNVD: CNNVD-201307-225

SOURCES

db:CNVDid:CNVD-2013-09590
db:BIDid:61044
db:PACKETSTORMid:123053
db:CNNVDid:CNNVD-201307-225
db:NVDid:CVE-2013-5620

LAST UPDATE DATE

2024-08-14T13:35:33.519000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2013-09590date:2013-07-16T00:00:00
db:BIDid:61044date:2013-09-03T00:11:00
db:CNNVDid:CNNVD-201307-225date:2013-09-03T00:00:00
db:NVDid:CVE-2013-5620date:2023-11-07T02:16:43.840

SOURCES RELEASE DATE

db:CNVDid:CNVD-2013-09590date:2013-07-16T00:00:00
db:BIDid:61044date:2013-07-09T00:00:00
db:PACKETSTORMid:123053date:2013-09-02T19:12:00
db:CNNVDid:CNNVD-201307-225date:2013-07-12T00:00:00
db:NVDid:CVE-2013-5620date:2013-09-17T12:04:24.773