ID

VAR-E-201605-0063


CVE

cve_id:CVE-2015-6023

Trust: 3.0

cve_id:CVE-2015-6024

Trust: 1.5

sources: BID: 96383 // PACKETSTORM: 136901 // EXPLOIT-DB: 39762 // EDBNET: 85599 // EDBNET: 85586

EDB ID

39762


TITLE

NetCommWireless HSPA 3G10WVE Wireless Router - Multiple Vulnerabilities - CGI webapps Exploit

Trust: 0.6

sources: EXPLOIT-DB: 39762

DESCRIPTION

NetCommWireless HSPA 3G10WVE Wireless Router - Multiple Vulnerabilities. CVE-2015-6024CVE-2015-6023 . webapps exploit for CGI platform

Trust: 0.6

sources: EXPLOIT-DB: 39762

AFFECTED PRODUCTS

vendor:netcommwirelessmodel:hspa 3g10wve wireless routerscope: - version: -

Trust: 1.0

vendor:netcommwirelessmodel:hspa 3g10wve authenticationscope: - version: -

Trust: 0.5

vendor:netcommmodel:wireless hspa 3g10wve-l101-s306etsscope: - version: -

Trust: 0.3

vendor:netcommmodel:wireless hspa 3g10wve-l101-s306etsscope:neversion: -

Trust: 0.3

sources: BID: 96383 // PACKETSTORM: 136901 // EXPLOIT-DB: 39762

EXPLOIT

Title:
====

NetCommWireless HSPA 3G10WVE Wireless Router – Multiple vulnerabilities

Credit:
======

Name: Bhadresh Patel
Company/affiliation: HelpAG
Website: www.helpag.com

CVE:
=====

CVE-2015-6023, CVE-2015-6024

Date:
====

03-05-2016 (dd/mm/yyyy)

Vendor:
======

NetComm Wireless is a leading developer and supplier of high performance
communication devices that connect businesses and people to the internet.

Products and services:
Wireless 3G/4G broadband devices
Custom engineered technologies
Broadband communication devices

Customers:
Telecommunications carriers
Internet Service Providers
System Integrators
Channel partners
Enterprise customers

Product:
=======

HSPA 3G10WVE is a wireless router

It integrates a wireless LAN, HSPA module and voice gateway into one
stylish unit. Insert an active HSPA SIM Card into the slot on the rear
panel & get instant access to 3G internet connection. Etisalat HSPA
3G10WVE wireless router incorporates a WLAN 802.11b/g access point, two
Ethernet 10/100Mbps ports for voice & fax. Featuring voice port which
means that one can stay connected using the internet & phone. If one
need a flexible internet connection for his business or at home; this is
the perfect solution.

Customer Product link: http://www.etisalat.ae/nrd/en/generic/3.5g_router.jsp

Abstract:
=======

Multiple vulnerabilities in the HSPA 3G10WVE wireless router enable an
anonymous unauthorized attacker to 1) bypass authentication and gain
unauthorized access of router's network troubleshooting page (ping.cgi)
and 2) exploit a command injection vulnerability on ping.cgi, which
could result in a complete system/network compromise.

Report-Timeline:
============
03-09-2015: Vendor notification
08-09-2015: Vendor Response/Feedback
02-05-2016: Vendor Fix/Patch
03-05-2016: Public Disclosure

Affected Software Version:
=============

3G10WVE-L101-S306ETS-C01_R03

Exploitation-Technique:
===================

Remote

Severity Rating (CVSS):
===================

10.0 (Critical) (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H)

Details:
=======

Below listed vulnerabilities enable an anonymous unauthorized attacker
to gain access of network troubleshooting page (ping.cgi) on wireless
router and inject commands to compromise full system/network.

1) Bypass authentication and gain unauthorized access vulnerability -
CVE-2015-6023
2) Command injection vulnerability - CVE-2016-6024

Vulnerable module/page/application: ping.cgi

Vulnerable parameter: DIA_IPADDRESS

Proof Of Concept:
================

PoC URL:
http(s)://<victim_IP>/ping.cgi?DIA_IPADDRESS=4.2.2.2;cat%20/etc/passwd

PoC Video: https://www.youtube.com/watch?v=FS43MRG7RDk

Patched/Fixed Firmware and notes:
==========================

ftp://files.planetnetcomm.com/3G10WVE/3G10WVE-L101-S306ETS-C01_R05.bin

NOTE: Verified only by Vendor

Credits:
=======

Bhadresh Patel
Senior Security Analyst
HelpAG (www.helpag.com)

Trust: 1.0

sources: EXPLOIT-DB: 39762

EXPLOIT LANGUAGE

txt

Trust: 0.6

sources: EXPLOIT-DB: 39762

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 39762

TYPE

Multiple Vulnerabilities

Trust: 1.0

sources: EXPLOIT-DB: 39762

TAGS

tag:exploit

Trust: 0.5

tag:remote

Trust: 0.5

tag:vulnerability

Trust: 0.5

tag:code execution

Trust: 0.5

tag:bypass

Trust: 0.5

sources: PACKETSTORM: 136901

CREDITS

Bhadresh Patel

Trust: 0.6

sources: EXPLOIT-DB: 39762

EXTERNAL IDS

db:NVDid:CVE-2015-6023

Trust: 3.0

db:EXPLOIT-DBid:39762

Trust: 1.6

db:NVDid:CVE-2015-6024

Trust: 1.5

db:EDBNETid:85599

Trust: 0.6

db:0DAYTODAYid:25278

Trust: 0.6

db:EDBNETid:85586

Trust: 0.6

db:PACKETSTORMid:136901

Trust: 0.5

db:BIDid:96383

Trust: 0.3

sources: BID: 96383 // PACKETSTORM: 136901 // EXPLOIT-DB: 39762 // EDBNET: 85599 // EDBNET: 85586

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2015-6023

Trust: 2.7

url:https://nvd.nist.gov/vuln/detail/cve-2015-6024

Trust: 1.5

url:https://www.exploit-db.com/exploits/39762/

Trust: 0.6

url:https://0day.today/exploits/25278

Trust: 0.6

url:http://seclists.org/fulldisclosure/2016/may/18

Trust: 0.3

url:http://www.netcommwireless.com/

Trust: 0.3

sources: BID: 96383 // PACKETSTORM: 136901 // EXPLOIT-DB: 39762 // EDBNET: 85599 // EDBNET: 85586

SOURCES

db:BIDid:96383
db:PACKETSTORMid:136901
db:EXPLOIT-DBid:39762
db:EDBNETid:85599
db:EDBNETid:85586

LAST UPDATE DATE

2022-07-27T09:32:33.991000+00:00


SOURCES UPDATE DATE

db:BIDid:96383date:2017-03-07T04:04:00

SOURCES RELEASE DATE

db:BIDid:96383date:2017-02-09T00:00:00
db:PACKETSTORMid:136901date:2016-05-03T23:16:49
db:EXPLOIT-DBid:39762date:2016-05-04T00:00:00
db:EDBNETid:85599date:2016-05-04T00:00:00
db:EDBNETid:85586date:2016-05-04T00:00:00