KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Weak Default WiFi Password Algorithm

`  
KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Weak Default WiFi Password Algorithm  
  
  
Vendor: KZ Broadband Technologies, Ltd. | Jaton Technology, Ltd.  
Product web page: http://www.kzbtech.com | http://www.jatontec.com | https://www.neotel.mk  
http://www.jatontec.com/products/show.php?itemid=258  
http://www.jatontech.com/CAT12.html#_pp=105_564  
http://www.kzbtech.com/AM3300V.html  
https://neotel.mk/ostanati-paketi-2/  
  
Affected version: Model | Firmware  
-------|---------  
JT3500V | 2.0.1B1064  
JT3300V | 2.0.1B1047  
AM6200M | 2.0.0B3210  
AM6000N | 2.0.0B3042  
AM5000W | 2.0.0B3037  
AM4200M | 2.0.0B2996  
AM4100V | 2.0.0B2988  
AM3500MW | 2.0.0B1092  
AM3410V | 2.0.0B1085  
AM3300V | 2.0.0B1060  
AM3100E | 2.0.0B981  
AM3100V | 2.0.0B946  
AM3000M | 2.0.0B21  
KZ7621U | 2.0.0B14  
KZ3220M | 2.0.0B04  
KZ3120R | 2.0.0B01  
  
Summary: JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi  
& VoIP CPE product specially designed to enable quick and easy  
LTE fixed data service deployment for residential and SOHO customers.  
It provides high speed LAN, Wi-Fi and VoIP integrated services  
to end users who need both bandwidth and multi-media data service  
in residential homes or enterprises. The device has 2 Gigabit LAN  
ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and  
CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing  
and firewall software for security. It provides an effective  
all-in-one solution to SOHO or residential customers. It can  
deliver up to 1Gbps max data throughput which can be very  
competitive to wired broadband access service.  
  
Desc: The device generates its SSID and password based on the  
WAN MAC address.  
  
Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN  
Linux 2.6.36+ (mips)  
Mediatek APSoC SDK v4.3.1.0  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2021-5638  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5638.php  
  
  
03.02.2021  
  
--  
  
  
Example defaults:  
  
# ifconfig |grep HWaddr  
br0 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D  
br0:9 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D  
eth2 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D  
eth2.1 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D  
eth2.100 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D  
eth2.1000 Link encap:Ethernet HWaddr 6C:AD:EF:16:7C:5D  
eth2.2 Link encap:Ethernet HWaddr 6C:AD:EF:FF:00:01  
ra0 Link encap:Ethernet HWaddr 6C:AD:EF:5D:7C:5C  
rai0 Link encap:Ethernet HWaddr 6C:AD:EF:5E:7C:5C  
  
SSID1=MyWiFi-167C5D  
SSID1=MyWiFi-5G-167C5D  
  
WiFi password = EF167C5D  
`