Sense of Security – Security Advisory – SOS-11-011
The NETGEAR Wireless Cable Modem Gateway CG814WG is supplied by ISP's as customer premises equipment within Australia and abroad. It is a centrally managed ISP solution whereby each ISP's devices run a customised firmware and configuration changes and updates can be pushed out as required. Basic authentication is used as the primary and only authentication mechanism for the administrator interface on the device. The basic authentication can be bypassed by sending a valid POST request to the device without sending any authentication header. The response from the device sends the user to another page that requests basic authentication, however at this point the request has already been processed. An example of attacks using the basic authentication bypass may include changing the admin password or enabling the remote admin interface (Internet facing). Additionally, due to the lack of CSRF protection in the web application, the bypass attack can be coupled with CSRF to have a victim enable the remote admin interface to the Internet, where an attacker can then use the bypass attack again across the remote admin interface to reset the admin password and access the device. This attack is possible when targeting a victim who is logged into the device.
