Telus Actiontec WEB6000Q Serial Number Information Disclosure

`-----BEGIN PGP SIGNED MESSAGE-----  
Hash: SHA256  
  
### Device Details  
Discovered By: Andrew Klaus ([email protected])  
Vendor: Actiontec (Telus Branded, but may work on others)  
Model: WEB6000Q  
Affected Firmware: 1.1.02.22  
  
Reported: Sept 2018  
CVE: Not needed since update is pushed by the provider.  
  
  
  
### Summary of Findings  
  
The wireless extenders use DHCP Option 125 to include device details  
such as model number, manufacturer, and serial number.  
  
The WCB6000Q DHCP DISCOVER and REQUEST broadcasts include the device  
serial number in the DHCP option 125 (subopt 2) field. An attacker on  
the same Layer 2 network segment as the device, can see all these DHCP  
requests with a packet capture.  
  
Once he or she has this, the device’s admin web UI password can be  
reset using the web UI “forgot password” page to reset to a known value.  
  
  
  
### Mitigation  
Do not use the serial number to initiate password resets.  
  
The serial number has other internal uses in the Web UI, which means  
there’s a higher chance of it being leaked over the network. By using a  
different value, this risk can be mitigated since the reset value is  
only used for that purpose.  
  
  
  
  
-----BEGIN PGP SIGNATURE-----  
  
iQIzBAEBCAAdFiEE/rRUDraOzqmrp8tZoyRid8jQfpkFAlz9UTIACgkQoyRid8jQ  
fpkVMRAA0fwfRQbpvp4/nsuqKrqmB8pGB8pLkw12LEC2nDwRnkq0qyTSlN34/7dA  
I+nSYGdqPZgDp/1lv1RmLuow42U7wNhFMy7zNElNyNrrztB57ItAJEBon9U2mtAh  
4cQd6u4i+qFOKEag2o810+nUAR2QNAi5vMkwrvQtiElXhhunDDk22jci8QN/YndP  
eb7j1BAygCL6BGZOuiUkv+2sXlGYHY+BfeV+wciTIvvevV1Bnrlmf1YNydnQKkfu  
unDtRfvGsUsg3YDbMcO5Uq3I1A7yFuH/Ai0uEtmQKkG9rELYiZkT0iW+n4TrFvts  
xw8GnANacBo3bITExs7zCiLL/uuv4H8gRyRM8ydnOv8ZiVZajYN3QxQ6EHoMnFq5  
JrNN9vMtmvrNkRarzsyUWEPHL2PPJIf9KLh2mnUtNaoTO0kD1ra/gK4JgJM6ra5Y  
EQfz7keaaI6zUvQKfnTZE57qglh5IY64CC3HAf3KtmLOzivCXCzNb1hjajd0X3Ax  
gwQMuR5b/SdvqV3uA3hbJs/cL61Qc892iNmJgMaKRpLBeDOVKVF7Ztww4VJtlNtf  
2a7isPX0Pt5h3b/PuT3v2/OEEi7dgB5bXTqCKlE8j2nXMIrFH6DL6eojeIp+wZzP  
UZ1eikvjwQCqtzTAFTYrCjv9Ss/FWtuYOzbksfJmNuTF+j9nBt8=  
=GA42  
-----END PGP SIGNATURE-----  
  
  
`