ZyXEL Router P-660HN-T1A - Login Bypass

vendor:

P-660HN-T1A

by:

Michael Grifalconi

6,4

CVSS

MEDIUM

287

CWE

Product Name: P-660HN-T1A

Affected Version From: 3.40(BYF.5)

Affected Version To: 3.40(BYF.5)

Patch Exists: No

Related CWE: N/A

CPE: cpe:h:zyxel:p-660hn-t1a

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

ZyXEL Router P-660HN-T1A – Login Bypass

If someone is logged on the web interface of the ZyXEL Router P-660HN-T1A, an attacker can bypass the login form by going straight to the default page of administration. The root page will ask for a password, but the vulnerability works from any IP address, allowing the router to be accessed from any IP when a legitimate user is logged in.

Mitigation:

Ensure that the router is not accessible from any IP address when a legitimate user is logged in.

Source

Exploit-DB raw data:

# Exploit Title: ZyXEL Router P-660HN-T1A - Login Bypass
# Date: 11/03/2013
# Exploit Author: Michael Grifalconi <NAME.SURNAME@studenti.unimi.it>
# Vendor Homepage: http://www.zyxel.com/products_services/p_660hn_txa_series.shtml?t=p
# Version: 3.40(BYF.5) - (Last avaiable)

If someone is logged on the web interface of the router, the attacker could 
bypass the login form by going straigt to the default page of administration.
(The root page will ask for password)

The vulnerability works from any IP address, the router seems to be 'free to access' from any IP 
when a legit user is logged in.

http://ROUTER-IP/rpSys.html

You may setup a bot that checks if someone is logged and if so, download the configuration backup
to obtain the password.