ID

VAR-E-201608-0509


TITLE

Huawei eSpace IAD Information Disclosure

Trust: 0.5

sources: PACKETSTORM: 138115

DESCRIPTION

Huawei eSpace IAD suffers from an information disclosure vulnerability.

Trust: 0.5

sources: PACKETSTORM: 138115

AFFECTED PRODUCTS

vendor:huaweimodel:espace iadscope: - version: -

Trust: 0.5

sources: PACKETSTORM: 138115

EXPLOIT

Title: Huawei eSpace IAD Remote Information Disclosure Vulnerability
Software : eSpace IAD

Software Version :
Equipment type : eSpace IAD208E(M)
PCB version : AG21CSPG VER.A
Product name : TS0801 and TS0802
Program version : V300R001C07SPC800
BIOS version : 1035
Slic version : 000
CPLD version : (U16)101
DSP version : VoIP V100R003C01

Vendor: www.huawei.com

Vulnerability Published : 2016-07-30

Author:zhiwei_jiang
Email:ak47464659484@gmail.com
Impact :
CVSS Severity (version 2.0):
CVSS v2 Base Score: 5.0 MEDIUM
Vector: (AV:N/AC:L/Au:N/C:P/I:N/A:N) (legend)
Impact Subscore: 2.9
Exploitability Subscore: 10.0
CVSS Version 2 Metrics:
Access Vector: Network exploitable
Access Complexity: Low
Authentication: Not required to exploit
Impact Type: Allows unauthorized disclosure of information

Bug Description :
The eSpace IAD Series Access Devices
Migrating to IP telephony? Huaweis eSpace Integrated Access Device (IAD) Series lets you support existing analog equipment to extend the useful life of legacy phones and fax machines. Available in a compact desktop model for a small office with 4 devices, or a 2U rack-mount system with up to 224 ports, providing Foreign eXchange Subscriber (FXS) interfaces.
Reliability features including triple homing, power-off survival, and network outage survival with multiple QoS mechanisms ensure high-availability, as well as high-quality voice services.
Integrates seamlessly with Huawei IP telephony and multimedia communications solutions.

eSpace IAD (ver Equipment type : eSpace IAD208E(M) Product name : TS0801 and TS0802 Program version : V300R001C07SPC800 ) an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions,Download sensitive data.

PoC:
http://x.x.x.x/goform/downloadIadInfomation

Solution :

For web applications, make sure that the access control mechanism is enforced correctly at the server side on every page. Users should not be able to access any unauthorized functionality or information by simply requesting direct access to that page.

One way to do this is to ensure that all pages containing sensitive information are not cached, and that all such pages restrict access to requests that are accompanied by an active and authenticated session token associated with a user who has the required permissions to access that page.

Trust: 0.5

sources: PACKETSTORM: 138115

EXPLOIT HASH

LOCAL

SOURCE

md5: 909cb3aa99d7741c5def7eebcbeb3c8e
sha-1: 9a1022a580be18ac092f9099df4dd7bbfcc3bad2
sha-256: 592b8d8e3b775a1526570b4633f85ec54f02c755da99534da9e6c89eba6f134e
md5: 909cb3aa99d7741c5def7eebcbeb3c8e

Trust: 0.5

sources: PACKETSTORM: 138115

PRICE

free

Trust: 0.5

sources: PACKETSTORM: 138115

TYPE

info disclosure

Trust: 0.5

sources: PACKETSTORM: 138115

TAGS

tag:exploit

Trust: 0.5

tag:info disclosure

Trust: 0.5

sources: PACKETSTORM: 138115

CREDITS

zhiwei_jiang

Trust: 0.5

sources: PACKETSTORM: 138115

EXTERNAL IDS

db:PACKETSTORMid:138115

Trust: 0.5

sources: PACKETSTORM: 138115

SOURCES

db:PACKETSTORMid:138115

LAST UPDATE DATE

2022-07-27T10:02:57.685000+00:00


SOURCES RELEASE DATE

db:PACKETSTORMid:138115date:2016-08-01T09:22:22