DASAN H660RM Information Disclosure / Hardcoded Key

`Hi!  
  
CVE-2019-9974: diag_tool.cgi on DASAN H660RM devices with firmware  
1.03-0022 allows spawning ping processes without any authorization  
leading to information disclosure and DoS attacks  
  
Remote attacker could enumerate hosts on LAN interface sending  
requests to /cgi-bin/diag_tool.cgi with ip parameter set to target IP  
address. Lack of authorization in /cgi-bin/diag_get_result.cgi allow  
retrieval of results. Each call to diag_get_result.cgi retrieves one  
line of ping (or traceroute) output.  
  
Same CGI script has another weakness, CWE-400: Uncontrolled Resource  
Consumption, which allows memory memory exhaustion Denial of Service  
(DoS) attack against device. Around 170 spawned ping processes is  
enough to cause crash and reboot of router. PoC exploit available.  
  
More: https://blog.burghardt.pl/2019/03/diag_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-allows-spawning-ping-processes-without-any-authorization-leading-to-information-disclosure-and-dos-attacks/  
  
  
CVE-2019-9975: syslog_tool.cgi on DASAN H660RM devices with firmware  
1.03-0022 uses a hard-coded key for logs encryption  
  
DASAN uses a hard-coded key “dasanektks123” for logs encryption. Data  
stored using this key can be decrypted by anyone able to access this  
key.  
  
More: https://blog.burghardt.pl/2019/03/syslog_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-uses-a-hard-coded-key-for-logs-encryption/  
  
  
CVE-2019-9976: Boa Webserver on DASAN H660RM devices with firmware  
1.03-0022 saves post data, including credentials, to /tmp/boa-temp  
  
Exploitation is possible for users logged in over telnet of SSH. If  
user logged though Web UI and until he make any other POST request,  
his credentials can be retrieved with:  
  
$ cat /tmp/boa-temp  
StatusActionFlag=-1&Username=admin&Password=vertex25  
  
More: https://blog.burghardt.pl/2019/03/boa-webserver-on-dasan-h660rm-devices-with-firmware-1-03-0022-saves-post-data-including-credentials-to-tmp-boa-temp/  
  
BR,  
--   
Krzysztof Burghardt <[email protected]>  
http://www.burghardt.pl/  
  
`