BSNL Teracom Router Firmware Rewrite / Link Modification

`Multiple Vulnerabilities in TERACOM ROUTER  
  
#Author: Ajay Gowtham aka AJOXR  
#Contact: gowtham.ajay5 at gmail.com  
#Vulnerability Type: Insecure Upload File Permissions  
#Affected Module: Upload Functionality  
#Criticality: Medium  
#Device Model: BSNL Teracom T2-B-Gawv1.4U10Y-BI is WiFi enabled ADSL2+  
compliant + WiFi  
#Firmware: 10.4.3.12.12  
----------------------------------------------------------------------------------------------  
Firmware Re-write using Unrestricted Upload of File (Insecure File Contents)  
  
Reference ID: CWE - 434  
CVE - ID : CVE-2015-2049, CVE-2015-2876  
  
Ref: https://cwe.mitre.org/data/definitions/434.html  
  
Description: Teracom T2-B-Gawv1.4u10Y-BI Models are having clear type text  
contents in Upload  
File in Restore Configuration. After Modifying file uploaded malicious  
scripts will be executed  
in Firmware of the affected model. Which will allow an attacker to carry  
out Arbitary Code  
Execution.  
  
Reproduce Vulnerability:  
  
Step 1: Go to Admin Pannel, you can find Backup file options to backup  
config.  
Step 2: Modify Config file Conexant.icf with malicious commands using Text  
Editor  
Step 3: Re-upload to the device using restore options  
Step 4: Router will restart and executes the malicious commands into router.  
Step 5: User will be using Malicious Router without concern as it will  
remain undetected also in  
antivirus.  
  
Solution: An update will be solution.  
----------------------------------------------------------------------------------------------  
Management Server Link Access to External Resource  
  
Reference ID: CWE - 610  
CVE - ID: CVE-2016-0071  
  
Ref: https://cwe.mitre.org/data/definitions/610.html  
  
Description: Teracom T2-B-Gawv1.4u10Y-BI Models accepting link  
modifications as no Hard-coded  
is provided in Management Server Module. Any User is able to change with  
default credentials.  
  
Step 1: Re-write the link in Management Server Module.  
Step 2: Apply necessary changes with malicious link.  
Step 3: Re-start the server and changes are made.  
  
Solution: Hard code the link parameter to avoid adding external resource  
link to the Router.  
----------------------------------------------------------------------------------------------  
  
PoC :  
https://drive.google.com/folderview?id=0B2p8gG1WpnRnek9GaEl3SXVod3c&usp=sharing  
`