ID
VAR-E-201605-0063
CVE
| cve_id: | CVE-2015-6023 | Trust: 3.0 |
| cve_id: | CVE-2015-6024 | Trust: 1.5 |
EDB ID
39762
TITLE
NetCommWireless HSPA 3G10WVE Wireless Router - Multiple Vulnerabilities - CGI webapps Exploit
Trust: 0.6
DESCRIPTION
NetCommWireless HSPA 3G10WVE Wireless Router - Multiple Vulnerabilities. CVE-2015-6024CVE-2015-6023 . webapps exploit for CGI platform
Trust: 0.6
AFFECTED PRODUCTS
| vendor: | netcommwireless | model: | hspa 3g10wve wireless router | scope: | - | version: | - | Trust: 1.0 |
| vendor: | netcommwireless | model: | hspa 3g10wve authentication | scope: | - | version: | - | Trust: 0.5 |
| vendor: | netcomm | model: | wireless hspa 3g10wve-l101-s306ets | scope: | - | version: | - | Trust: 0.3 |
| vendor: | netcomm | model: | wireless hspa 3g10wve-l101-s306ets | scope: | ne | version: | - | Trust: 0.3 |
EXPLOIT
Title:
====
NetCommWireless HSPA 3G10WVE Wireless Router – Multiple vulnerabilities
Credit:
======
Name: Bhadresh Patel
Company/affiliation: HelpAG
Website: www.helpag.com
CVE:
=====
CVE-2015-6023, CVE-2015-6024
Date:
====
03-05-2016 (dd/mm/yyyy)
Vendor:
======
NetComm Wireless is a leading developer and supplier of high performance
communication devices that connect businesses and people to the internet.
Products and services:
Wireless 3G/4G broadband devices
Custom engineered technologies
Broadband communication devices
Customers:
Telecommunications carriers
Internet Service Providers
System Integrators
Channel partners
Enterprise customers
Product:
=======
HSPA 3G10WVE is a wireless router
It integrates a wireless LAN, HSPA module and voice gateway into one
stylish unit. Insert an active HSPA SIM Card into the slot on the rear
panel & get instant access to 3G internet connection. Etisalat HSPA
3G10WVE wireless router incorporates a WLAN 802.11b/g access point, two
Ethernet 10/100Mbps ports for voice & fax. Featuring voice port which
means that one can stay connected using the internet & phone. If one
need a flexible internet connection for his business or at home; this is
the perfect solution.
Customer Product link: http://www.etisalat.ae/nrd/en/generic/3.5g_router.jsp
Abstract:
=======
Multiple vulnerabilities in the HSPA 3G10WVE wireless router enable an
anonymous unauthorized attacker to 1) bypass authentication and gain
unauthorized access of router's network troubleshooting page (ping.cgi)
and 2) exploit a command injection vulnerability on ping.cgi, which
could result in a complete system/network compromise.
Report-Timeline:
============
03-09-2015: Vendor notification
08-09-2015: Vendor Response/Feedback
02-05-2016: Vendor Fix/Patch
03-05-2016: Public Disclosure
Affected Software Version:
=============
3G10WVE-L101-S306ETS-C01_R03
Exploitation-Technique:
===================
Remote
Severity Rating (CVSS):
===================
10.0 (Critical) (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)
Details:
=======
Below listed vulnerabilities enable an anonymous unauthorized attacker
to gain access of network troubleshooting page (ping.cgi) on wireless
router and inject commands to compromise full system/network.
1) Bypass authentication and gain unauthorized access vulnerability -
CVE-2015-6023
2) Command injection vulnerability - CVE-2016-6024
Vulnerable module/page/application: ping.cgi
Vulnerable parameter: DIA_IPADDRESS
Proof Of Concept:
================
PoC URL:
http(s)://<victim_IP>/ping.cgi?DIA_IPADDRESS=4.2.2.2;cat%20/etc/passwd
PoC Video: https://www.youtube.com/watch?v=FS43MRG7RDk
Patched/Fixed Firmware and notes:
==========================
ftp://files.planetnetcomm.com/3G10WVE/3G10WVE-L101-S306ETS-C01_R05.bin
NOTE: Verified only by Vendor
Credits:
=======
Bhadresh Patel
Senior Security Analyst
HelpAG (www.helpag.com)
Trust: 1.0
EXPLOIT LANGUAGE
txt
Trust: 0.6
PRICE
free
Trust: 0.6
TYPE
Multiple Vulnerabilities
Trust: 1.0
TAGS
| tag: | exploit | Trust: 0.5 |
| tag: | remote | Trust: 0.5 |
| tag: | vulnerability | Trust: 0.5 |
| tag: | code execution | Trust: 0.5 |
| tag: | bypass | Trust: 0.5 |
CREDITS
Bhadresh Patel
Trust: 0.6
EXTERNAL IDS
| db: | NVD | id: | CVE-2015-6023 | Trust: 3.0 |
| db: | EXPLOIT-DB | id: | 39762 | Trust: 1.6 |
| db: | NVD | id: | CVE-2015-6024 | Trust: 1.5 |
| db: | EDBNET | id: | 85599 | Trust: 0.6 |
| db: | 0DAYTODAY | id: | 25278 | Trust: 0.6 |
| db: | EDBNET | id: | 85586 | Trust: 0.6 |
| db: | PACKETSTORM | id: | 136901 | Trust: 0.5 |
| db: | BID | id: | 96383 | Trust: 0.3 |
REFERENCES
| url: | https://nvd.nist.gov/vuln/detail/cve-2015-6023 | Trust: 2.7 |
| url: | https://nvd.nist.gov/vuln/detail/cve-2015-6024 | Trust: 1.5 |
| url: | https://www.exploit-db.com/exploits/39762/ | Trust: 0.6 |
| url: | https://0day.today/exploits/25278 | Trust: 0.6 |
| url: | http://seclists.org/fulldisclosure/2016/may/18 | Trust: 0.3 |
| url: | http://www.netcommwireless.com/ | Trust: 0.3 |
SOURCES
| db: | BID | id: | 96383 |
| db: | PACKETSTORM | id: | 136901 |
| db: | EXPLOIT-DB | id: | 39762 |
| db: | EDBNET | id: | 85599 |
| db: | EDBNET | id: | 85586 |
LAST UPDATE DATE
2022-07-27T09:32:33.991000+00:00
SOURCES UPDATE DATE
| db: | BID | id: | 96383 | date: | 2017-03-07T04:04:00 |
SOURCES RELEASE DATE
| db: | BID | id: | 96383 | date: | 2017-02-09T00:00:00 |
| db: | PACKETSTORM | id: | 136901 | date: | 2016-05-03T23:16:49 |
| db: | EXPLOIT-DB | id: | 39762 | date: | 2016-05-04T00:00:00 |
| db: | EDBNET | id: | 85599 | date: | 2016-05-04T00:00:00 |
| db: | EDBNET | id: | 85586 | date: | 2016-05-04T00:00:00 |