ZyXEL DEL1201-T10A Authorization Bypass Vulnerability

Document Title:
===============
ZyXEL DEL1201-T10A Authorization Bypass


Release Date:
=============
2016-nov-03


Timeline:
=========
2016-oct-30 --> Discovered
2016-oct-30 --> Reported To Vonder
2016-nov-02 --> Vondder Dosn't Reply
2016-nov-03 --> Published


Exploitation Technique:
=======================
Local Exploit


Severity Level:
===============
Medium


Affected Model(s):
==================
DEL1201-T10A


Vulnerability Typus:
====================
Authorization Bypass


Product & Service Introduction:
===============================
Focused on innovation and customer-centricity, Zyxel Communications Corp. has been connecting people to the internet for nearly 30 years.
We keep promoting creativity which meets the needs of customers. This spirit has never been changed since we developed the world's first 
integrated 3-in-1 data/fax/voice modem in 1992. Our ability to adapt and innovate with networking technology places us at the forefront 
of understanding connectivity for telco/service providers, businesses and home users.
We're building the networks of tomorrow, helping unlock the world's potential and meeting the needs of the modern workplace; powering people at work,
life and play. We stand side-by-side with our customers and partners to share new approaches to networking that will unleash their abilities.
Loyal friend, powerful ally, reliable resource — we are Zyxel, Your Networking Ally.

(Copy of the Homepage: https://www.zyxel.com/about_zyxel/company_overview.shtml )


Description:
============
ZyXEL DEL1201-T10A Modem Default Password is : admin
In RealyIf Network Administrator Change The The Default Password To Any , We Can't Access To Modem Settings . Because We Don't Know 
New Password . But Authorization Bypass Access We To Change Modem Settings !


Technical Details:
==================
an Authorization Bypass That Access To Edit/Change Modem Wireless Settings !


Proof of Concept (PoC):
=======================
Manual Steps To Reproduce The Local Vulnerability ...

    1. Connect To Modem
    2. Enter Modem Gatway Address To Browser (url:192.168.1.1)
    3. Enter This String To Password Field -> user
    4. Now You Can Change Wireless Settings..!

Credits & Authors:
==================
Mohammad Reza Fathi

Source:
=======
http://www.micle.ir/exploits/1002

#  0day.today [2018-01-05]  #