KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm

vendor:

JT3500V

by:

LiquidWorm

8.8

CVSS

HIGH

Weak Default WiFi Password Algorithm

521

CWE

Product Name: JT3500V

Affected Version From: 2.0.0B01

Affected Version To: 2.0.1B1064

Patch Exists: No

Related CWE: N/A

CPE: h:kzbtech:jt3500v

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2021

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 – Weak Default WiFi Password Algorithm

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 is vulnerable to a weak default WiFi password algorithm. The default WiFi password is generated based on the MAC address of the device. The algorithm is predictable and can be easily guessed by an attacker. This allows an attacker to gain access to the device and potentially gain access to the network.

Mitigation:

Users should change the default WiFi password to a strong and unique password.

Source

Exploit-DB raw data:

# Exploit Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 - Weak Default WiFi Password Algorithm
# Date: 03.02.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.kzbtech.com http://www.jatontec.com https://www.neotel.mk

Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd.
Product web page: http://www.kzbtech.com | http://www.jatontec.com | https://www.neotel.mk
                  http://www.jatontec.com/products/show.php?itemid=258
                  http://www.jatontech.com/CAT12.html#_pp=105_564
                  http://www.kzbtech.com/AM3300V.html
                  https://neotel.mk/ostanati-paketi-2/

Affected version:  Model | Firmware
                  -------|---------
                 JT3500V | 2.0.1B1064
                 JT3300V | 2.0.1B1047
                 AM6200M | 2.0.0B3210
                 AM6000N | 2.0.0B3042
                 AM5000W | 2.0.0B3037
                 AM4200M | 2.0.0B2996
                 AM4100V | 2.0.0B2988
                AM3500MW | 2.0.0B1092
                 AM3410V | 2.0.0B1085
                 AM3300V | 2.0.0B1060
                 AM3100E | 2.0.0B981
                 AM3100V | 2.0.0B946
                 AM3000M | 2.0.0B21
                 KZ7621U | 2.0.0B14
                 KZ3220M | 2.0.0B04
                 KZ3120R | 2.0.0B01

Summary: JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi
& VoIP CPE product specially designed to enable quick and easy
LTE fixed data service deployment for residential and SOHO customers.
It provides high speed LAN, Wi-Fi and VoIP integrated services
to end users who need both bandwidth and multi-media data service
in residential homes or enterprises. The device has 2 Gigabit LAN
ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and
CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing
and firewall software for security. It provides an effective
all-in-one solution to SOHO or residential customers. It can
deliver up to 1Gbps max data throughput which can be very
competitive to wired broadband access service.

Desc: The device generates its SSID and password based on the
WAN MAC address.

Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN
           Linux 2.6.36+ (mips)
           Mediatek APSoC SDK v4.3.1.0


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5638
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5638.php


03.02.2021

--


Example defaults:

# ifconfig |grep HWaddr
br0       Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
br0:9     Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2      Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2.1    Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2.100  Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2.1000 Link encap:Ethernet  HWaddr 6C:AD:EF:16:7C:5D
eth2.2    Link encap:Ethernet  HWaddr 6C:AD:EF:FF:00:01
ra0       Link encap:Ethernet  HWaddr 6C:AD:EF:5D:7C:5C
rai0      Link encap:Ethernet  HWaddr 6C:AD:EF:5E:7C:5C

SSID1=MyWiFi-167C5D
SSID1=MyWiFi-5G-167C5D

WiFi password = EF167C5D