Multiple vulnerabilities on Sitecom N300/N600 devices
=====================================================

[ADVISORY INFORMATION]
Title:    Multiple vulnerabilities on Sitecom N300/N600 devices
Discovery date: 01/06/2013
Release date:   19/08/2013
Credits:   Roberto Paleari     (roberto.paleari@emaze.net, @rpaleari)
    Alessandro Di Pinto (alessandro.dipinto@emaze.net, @adipinto)
Advisory URL:   http://blog.emaze.net/2013/08/multiple-vulnerabilities-on-sitecom.html

[AFFECTED PRODUCTS]
We confirm the presence of the security vulnerability on the following
products/firmware versions:
   * Sitecom WLM-3500 v2 001, firmware 1.07
   * Sitecom WLM-5500 v1 001, firmware 1.15
Other device models and firmware versions are probably also vulnerable, but
they were not checked.

[VULNERABILITY DETAILS]
The firmware running on the affected devices is prone to multiple security
issues that allow attackers to bypass existing authentication mechanisms and
gain administrative access to the device, with root privileges.

In detail, affected firmware versions generate the default WPA2 key and access
credentials starting from publicly-accessible information, such as the MAC
address for the Wi-Fi interface. In addition, there is an undocumented URL that
enables the Telnet service on the WAN site; attackers can then login using an
hard-coded (and unchangeable) username/password combination.

Details about these vulnerabilities are given next.

a) WPA2/admin password generation algorithm

The WPA2 passphrase and the password for the administrative web user are
generated starting from the MAC address of the wireless interface
card. Attackers located nearby the device (i.e., within the Wi-Fi network
range) can calculate the default wireless password and access the device (if
the passphrase has not been changed by the user). A Python implementation
of the key generation algorithm is provided on Emaze blog (see the initial
"Advisory information" section for the URL).

b) Undocumented Telnet service

Unauthenticated remote users can enable the Telnet server by accessing the
following (undocumented) URL:

http://<target-ip>/cgi-bin/telnetControl.cgi

This URL can be also accessed on the WAN side, allowing Internet-based
attackers to enable the Telnet server. After activation, the service remains
open until the next reboot. Additionally, due to the hard-coded credentials
shown in the next paragraphs, attackers can easily login to the Telnet daemon.

c) Hard-coded credentials

A user can login to the Telnet service (with root privileges) using the
hard-coded credential "admin:1234". This administrative account is hard-coded
and cannot be changed by a normal user.

[REMEDIATION] 
Sitecom has promptly released updated firmware versions to address the Telnet
issue. Patched software images are now distributed to end-users through the
automatic firmware upgrade feature. The security patches have been included
inside the following firmware versions:
- WLM-3500v2001, v1.08
- WLM-5501v1001, v2.01

In addition, Sitecom confirmed that the algorithm for the generation of
WPA2/admin passphrases discussed in the present report is valid only for
WLM-3500 and WLM-5501 devices. New device models should not be affected by the
same issue.

[COPYRIGHT]
Copyright(c) Emaze Networks S.p.A 2013, All rights reserved worldwide.
Permission is hereby granted to redistribute this advisory, providing that no
changes are made and that the copyright notices and disclaimers remain intact.

[DISCLAIMER]
Emaze Networks S.p.A is not responsible for the misuse of the information
provided in our security advisories. These advisories are a service to the
professional security community. There are NO WARRANTIES with regard to this
information. Any application or distribution of this information constitutes
acceptance AS IS, at the user's own risk. This information is subject to change
without notice.