ID
VAR-E-201411-0052
CVE
| cve_id: | CVE-2014-9020 | Trust: 1.3 |
| cve_id: | CVE-2014-9183 | Trust: 0.8 |
| cve_id: | CVE-2014-9019 | Trust: 0.8 |
| cve_id: | CVE-2014-9021 | Trust: 0.5 |
TITLE
ZTE 831CII Hardcoded Credential / XSS / CSRF
Trust: 0.5
DESCRIPTION
ZTE 831CII suffers from cross site request forgery, hardcoded administrative credential, and cross site scripting vulnerabilities.
Trust: 0.5
AFFECTED PRODUCTS
| vendor: | zte | model: | 831cii hardcoded credential | scope: | - | version: | - | Trust: 0.5 |
| vendor: | zte | model: | zxdsl | scope: | eq | version: | 831 | Trust: 0.5 |
EXPLOIT
Hardcoded default misconfiguration - The modem comes with admin:admin user credintials.
Stored XSS - http://192.168.1.1/psilan.cgi?action=saveðIpAddress=192.168.1.1ðSubnetMask=255.255.255.0&hostname=ZXDSL83C1II&domainname=home%27;alert%280%29;//&enblUpnp=1&enblLan2=0
Any user browsing to http://192.168.1.1/main.html will have a stored xss executed!
CSRF based Stored XSS - http://192.168.1.1/adminpasswd.cgi?action=save&sysUserName=%27;alert%280%29;//&sysPassword=37F6E6F627B6 - letting an admin visit this link would result the admin username changed to ';alert(0);// also a stored XSS in the home page.
CSRF - there is no token/capcha or even current password prompt when the admin changes the password, and creditintials are sent over GET. PoC: http://192.168.1.1/adminpasswd.cgi?action=save&sysUserName=admin&sysPassword=F6C656269697
if an authenticated admin browses that link their credintials will become admin:yibelo
UI Redressing - The modem (like most modems) does not have a clickjacking protection. thus, can be used to modify settings, override admin accounts by a simple clickjack. forexample by using http://192.168.1.1/adminpasswd.html it is possible into tricking an admin submit a form with our credintials (since it doesn't require current password)
not using SSL - The modem does not use HTTPS, so anyone can use MiTM to sniff on going actions, possibly gain user credintials.
Unrestricted privileges - anyone who is connected to the modem with Telnet or tftp is root. simply telneting and authenticating as admin:admin and typing sh and echo $USER would prove that.
Trust: 0.5
EXPLOIT HASH
LOCAL | SOURCE | ||||||||
|
|
Trust: 0.5
PRICE
free
Trust: 0.5
TYPE
xss, csrf
Trust: 0.5
TAGS
| tag: | exploit | Trust: 1.0 |
| tag: | vulnerability | Trust: 1.0 |
| tag: | xss | Trust: 1.0 |
| tag: | csrf | Trust: 0.5 |
CREDITS
Paulos Yibelo
Trust: 0.5
EXTERNAL IDS
| db: | NVD | id: | CVE-2014-9020 | Trust: 1.3 |
| db: | NVD | id: | CVE-2014-9183 | Trust: 0.8 |
| db: | NVD | id: | CVE-2014-9019 | Trust: 0.8 |
| db: | PACKETSTORM | id: | 129016 | Trust: 0.5 |
| db: | NVD | id: | CVE-2014-9021 | Trust: 0.5 |
| db: | PACKETSTORM | id: | 129017 | Trust: 0.5 |
| db: | BID | id: | 70984 | Trust: 0.3 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2014-9020 | Trust: 1.0 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2014-9019 | Trust: 0.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2014-9183 | Trust: 0.5 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2014-9021 | Trust: 0.5 |
SOURCES
| db: | BID | id: | 70984 |
| db: | PACKETSTORM | id: | 129016 |
| db: | PACKETSTORM | id: | 129017 |
LAST UPDATE DATE
2022-07-27T09:18:46.140000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 70984 | date: | 2014-12-09T00:55:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 70984 | date: | 2014-11-06T00:00:00 |
| db: | PACKETSTORM | id: | 129016 | date: | 2014-11-07T16:52:33 |
| db: | PACKETSTORM | id: | 129017 | date: | 2014-11-07T16:56:04 |