Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak

🗓️ 27 Dec 2017 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 69 Views

Telesquare SDT-CS3B1 LTE Router Insecure Object Reference Leak

Reporter	Title	Published	Views	Family All 11
ATTACKERKB	CVE-2017-20223	16 Mar 202601:28	–	attackerkb
Circl	CVE-2017-20223	16 Jun 202612:37	–	circl
CNNVD	Telesquare SKT LTE Router SDT-CS3B1 安全漏洞	16 Mar 202600:00	–	cnnvd
CVE	CVE-2017-20223	16 Mar 202601:28	–	cve
Cvelist	CVE-2017-20223 Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference	16 Mar 202601:28	–	cvelist
EUVD	EUVD-2017-18939	16 Mar 202615:30	–	euvd
NVD	CVE-2017-20223	16 Mar 202614:17	–	nvd
OpenVAS	Telesquare SKT LTE Router SDT-CS3B1 Multiple Vulnerabilities - Active Check	28 Dec 201700:00	–	openvas
Positive Technologies	PT-2026-25741	16 Mar 202600:00	–	ptsecurity
RedhatCVE	CVE-2017-20223	26 Mar 202615:04	–	redhatcve

<html><body><p>Telesquare SKT LTE Router SDT-CS3B1 Insecure Direct Object Reference Info Leak


Vendor: Telesquare Co., Ltd.
Product web page: http://www.telesquare.co.kr
Affected version: FwVer: SDT-CS3B1, sw version 1.2.0
                  LteVer: ML300S5XEA41_090  1 0.1.0
                  Modem model: PM-L300S

Summary: We introduce SDT-CS3B1 LTE router which is a SKT 3G and 4G
LTE wireless communication based LTE router product.

Desc: Insecure direct object references occur when an application
provides direct access to objects based on user-supplied input. As
a result of this vulnerability attackers can bypass authorization
and access resources and functionalities in the system.

Tested on: lighttpd/1.4.20
Linux mips


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2017-5445
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2017-5445.php


22.12.2017

--



/home.html                                  &lt;&lt;  Version and status info leak (firmware, device, type, modem, lte)
/index.html                                 &lt;&lt;  Version and status info leak (firmware, device, type, modem, lte)
/nas/smbsrv.shtml                           &lt;&lt;  Samba server settings (workgroup, netbios name)
/nas/ftpsrv.shtml                           &lt;&lt;  FTP settings
/wifi2g/basic.shtml                         &lt;&lt;  Wireless settings
/admin/status.shtml                         &lt;&lt;  Access point status info leak
/internet/wan.shtml                         &lt;&lt;  WAN settings info leak (wanip, subnet, gateway, macaddr, lteipaddr, dns)
/internet/lan.shtml                         &lt;&lt;  LAN settings info leak (dhcpip, lanip, macaddr, gateway, subnet, dns)
/admin/statistic.shtml                      &lt;&lt;  System statistics info leak
/admin/management.shtml                     &lt;&lt;  System management (account settings, ntp settings, ddns settings)
/serial/serial_direct.shtml                 &lt;&lt;  Direct serial settings (network connection settings, serverip, port)
/admin/system_command.shtml                 &lt;&lt;  System command interface
/internet/dhcpcliinfo.shtml                 &lt;&lt;  DHCP Clients info leak (hostname, macaddr, ipaddr)
/admin/upload_firmware.shtml                &lt;&lt;  Router firmware and lte firmware upgrade
/firewall/vpn_futuresystem.shtml            &lt;&lt;  VPN settings (udp packet transfer, icmp check)
/cgi-bin/lte.cgi?Command=getUiccState       &lt;&lt;  GetUiccState()
/cgi-bin/lte.cgi?Command=getModemStatus     &lt;&lt;  Modem status info leak
/cgi-bin/systemutil.cgi?Command=SystemInfo  &lt;&lt;  System info leak
</p></body></html>

27 Dec 2017 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 49.3

CVSS 3.19.8

EPSS0.00524

SSVC