[FD] ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability

Document Title: =============== ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability References (Source): ==================== http://ift.tt/1GbmO1o Release Date: ============= 2015-06-16 Vulnerability Laboratory ID (VL-ID): ==================================== 1522 Common Vulnerability Scoring System: ==================================== 6 Product & Service Introduction: =============================== ZTE zxv10 w300 ADSL wireless router cat family gateway (accessories include a host, a power line, a line of 1 root, separator, 1) (Copy of the Vendor Homepage: http://ift.tt/1cWWrCh ) Abstract Advisory Information: ============================== The Vulnerability Laboratory Research Team discovered a remote vulnerability in the official ZTE Corporation ZXV10 W300 v3.1.0c_DR0 modem hardware. Vulnerability Disclosure Timeline: ================================== 2015-06-16: Public Disclosure (Vulnerability Laboratory) Discovery Status: ================= Published Affected Product(s): ==================== ZTE Corporation Product: ZTE ZXV10 W300 3.1.0c_DR0 Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ A session vulnerability has been discovered in the official ZTE Corporation ZXV10 W300 v3.1.0c_DR0 modem hardware. The security vulnerability allows remote attackers to block/shutedown or delete network settings and components. The LAN configuration post to /Forms/home_lan_1 and the page /home_lan_1 that stores the configuration of the router. Attackers can request via GET method the /Forms/home_lan_1 path and the modem will delete all the LAN configurations automatically. The problem is the GET method request with the /Forms/home_lan_1 path that deletes all the configurations. A hard reset is required after successful exploitation of the issue. The security risk of the router ui web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.0. Exploitation of the security web vulnerability requires no privilege web-application user account and low user interaction (click link). Successful exploitation of the vulnerability results in reset of the modem device, shutdown of the network/lan or compromise of running services. Request Method(s): [+] POST Vulnerable Module(s): [+] Forms/ Affected Module(s): [+] home_lan_1 Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers without privilege application user account and low user interaction (click). For security demonstration or to reproduce follow the provided information and steps below to continue.

Source: Gmail -> IFTTT-> Blogger