ZTE 831CII Multiple Vulnerablities

Type securityvulns
Reporter Securityvulns
Modified 2014-11-10T00:00:00


Hardcoded default misconfiguration - The modem comes with admin:admin user credintials.

Stored XSS -;alert%280%29;//&enblUpnp=1&enblLan2=0 Any user browsing to will have a stored xss executed!

CSRF based Stored XSS -;alert%280%29;//&sysPassword=37F6E6F627B6 - letting an admin visit this link would result the admin username changed to ';alert(0);// also a stored XSS in the home page.

CSRF - there is no token/capcha or even current password prompt when the admin changes the password, and creditintials are sent over GET. PoC: if an authenticated admin browses that link their credintials will become admin:yibelo

UI Redressing - The modem (like most modems) does not have a clickjacking protection. thus, can be used to modify settings, override admin accounts by a simple clickjack. forexample by using it is possible into tricking an admin submit a form with our credintials (since it doesn't require current password)

not using SSL - The modem does not use HTTPS, so anyone can use MiTM to sniff on going actions, possibly gain user credintials.

Unrestricted privileges - anyone who is connected to the modem with Telnet or tftp is root. simply telneting and authenticating as admin:admin and typing sh and echo $USER would prove that.