ZyXEL Router P-660HN-T1A - Login Bypass Vulnerability

2014-03-12T00:00:00
ID 1337DAY-ID-22018
Type zdt
Reporter Michael Grifalconi
Modified 2014-03-12T00:00:00

Description

Exploit for hardware platform in category web applications

                                        
                                            # Exploit Title: ZyXEL Router P-660HN-T1A - Login Bypass
# Date: 11/03/2013
# Exploit Author: Michael Grifalconi <[email protected]>
# Vendor Homepage: http://www.zyxel.com/products_services/p_660hn_txa_series.shtml?t=p
# Version: 3.40(BYF.5) - (Last avaiable)
 
If someone is logged on the web interface of the router, the attacker could
bypass the login form by going straigt to the default page of administration.
(The root page will ask for password)
 
The vulnerability works from any IP address, the router seems to be 'free to access' from any IP
when a legit user is logged in.
 
http://ROUTER-IP/rpSys.html
 
You may setup a bot that checks if someone is logged and if so, download the configuration backup
to obtain the password.

#  0day.today [2018-01-05]  #