Sign-up

ID

VAR-201702-0312


CVE

CVE-2015-6023


TITLE

NetCommWireless HSPA 3G10WVE Wireless Router Of firmware ping.cgi Vulnerable to access restrictions

Trust: 0.8

sources: JVNDB: JVNDB-2015-007391

DESCRIPTION

ping.cgi in NetCommWireless HSPA 3G10WVE wireless routers with firmware before 3G10WVE-L101-S306ETS-C01_R05 allows remote attackers to bypass intended access restrictions via a direct request. NOTE: this issue can be combined with CVE-2015-6024 to execute arbitrary commands. HELPNetCommWirelessHSPA3G10WVE is a wireless router product from HELP of the United Arab Emirates. This may lead to further attacks. NetCommWireless Wireless Router 3G10WVE-L101-S306ETS-C01_R03 is vulnerable; other versions may also be affected. Title: ==== NetCommWireless HSPA 3G10WVE Wireless Router \x96 Multiple vulnerabilities Credit: ====== Name: Bhadresh Patel Company/affiliation: HelpAG Website: www.helpag.com CVE: ===== CVE-2015-6023, CVE-2016-6024 Date: ==== 03-05-2016 (dd/mm/yyyy) Vendor: ====== NetComm Wireless is a leading developer and supplier of high performance communication devices that connect businesses and people to the internet. Products and services: Wireless 3G/4G broadband devices Custom engineered technologies Broadband communication devices Customers: Telecommunications carriers Internet Service Providers System Integrators Channel partners Enterprise customers Product: ======= HSPA 3G10WVE is a wireless router It integrates a wireless LAN, HSPA module and voice gateway into one stylish unit. Insert an active HSPA SIM Card into the slot on the rear panel & get instant access to 3G internet connection. Featuring voice port which means that one can stay connected using the internet & phone. If one need a flexible internet connection for his business or at home; this is the perfect solution. Report-Timeline: ============ 03-09-2015: Vendor notification 08-09-2015: Vendor Response/Feedback 02-05-2016: Vendor Fix/Patch 03-05-2016: Public Disclosure Affected Software Version: ============= 3G10WVE-L101-S306ETS-C01_R03 Exploitation-Technique: =================== Remote Severity Rating (CVSS): =================== 10.0 (Critical) (AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H) Details: ======= Below listed vulnerabilities enable an anonymous unauthorized attacker to gain access of network troubleshooting page (ping.cgi) on wireless router and inject commands to compromise full system/network. 1) Bypass authentication and gain unauthorized access vulnerability - CVE-2015-6023 2) Command injection vulnerability - CVE-2016-6024 Vulnerable module/page/application: ping.cgi Vulnerable parameter: DIA_IPADDRESS Proof Of Concept: ================ PoC URL: http(s)://<victim_IP>/ping.cgi?DIA_IPADDRESS=4.2.2.2;cat%20/etc/passwd PoC Video: https://www.youtube.com/watch?v=FS43MRG7RDk Patched/Fixed Firmware and notes: ========================== ftp://files.planetnetcomm.com/3G10WVE/3G10WVE-L101-S306ETS-C01_R05.bin NOTE: Verified only by Vendor Credits: ======= Bhadresh Patel Senior Security Analyst HelpAG (www.helpag.com)

Trust: 2.7

sources: NVD: CVE-2015-6023 // JVNDB: JVNDB-2015-007391 // CNVD: CNVD-2016-02892 // BID: 96383 // VULHUB: VHN-83984 // VULMON: CVE-2015-6023 // PACKETSTORM: 136901

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2016-02892

AFFECTED PRODUCTS

vendor:netcommwirelessmodel:hspa 3g10wvescope:eqversion:3g10wve-l101-s306ets-c01_r03

Trust: 1.6

vendor:netcommmodel:netcommwireless hspa 3g10wvescope: - version: -

Trust: 0.8

vendor:netcommmodel:netcommwireless hspa 3g10wvescope:ltversion:3g10wve-l101-s306ets-c01_r05

Trust: 0.8

vendor:helpmodel:netcommwireless hspa 3g10wvescope: - version: -

Trust: 0.6

vendor:netcommmodel:wireless hspa 3g10wve-l101-s306etsscope: - version: -

Trust: 0.3

vendor:netcommmodel:wireless hspa 3g10wve-l101-s306etsscope:neversion: -

Trust: 0.3

sources: CNVD: CNVD-2016-02892 // BID: 96383 // JVNDB: JVNDB-2015-007391 // CNNVD: CNNVD-201605-127 // NVD: CVE-2015-6023

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2015-6023
value: HIGH

Trust: 1.0

NVD: CVE-2015-6023
value: HIGH

Trust: 0.8

CNVD: CNVD-2016-02892
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201605-127
value: HIGH

Trust: 0.6

VULHUB: VHN-83984
value: HIGH

Trust: 0.1

VULMON: CVE-2015-6023
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2015-6023
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.9

CNVD: CNVD-2016-02892
severity: HIGH
baseScore: 9.0
vectorString: AV:N/AC:L/AU:S/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: SINGLE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 8.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-83984
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2015-6023
baseSeverity: HIGH
baseScore: 7.3
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: LOW
exploitabilityScore: 3.9
impactScore: 3.4
version: 3.0

Trust: 1.8

sources: CNVD: CNVD-2016-02892 // VULHUB: VHN-83984 // VULMON: CVE-2015-6023 // JVNDB: JVNDB-2015-007391 // CNNVD: CNNVD-201605-127 // NVD: CVE-2015-6023

PROBLEMTYPE DATA

problemtype:CWE-284

Trust: 1.9

sources: VULHUB: VHN-83984 // JVNDB: JVNDB-2015-007391 // NVD: CVE-2015-6023

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 136901 // CNNVD: CNNVD-201605-127

TYPE

permissions and access control

Trust: 0.6

sources: CNNVD: CNNVD-201605-127

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2015-007391

EXPLOIT AVAILABILITY
sources:
            
            
            VULHUB: VHN-83984 // 
            
            
            
            VULMON: CVE-2015-6023

PATCH
title:Top Pageurl:http://www.netcommwireless.com/
Trust: 0.8
title:HELPNetCommWirelessHSPA3G10WVE Security Bypass Vulnerability Patchurl:https://www.cnvd.org.cn/patchInfo/show/75437
Trust: 0.6
title:NetCommWireless HSPA 3G10WVE Security vulnerabilitiesurl:http://www.cnnvd.org.cn/web/xxk/bdxqById.tag?id=61450
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2016-02892 // 
            
            
            
            JVNDB: JVNDB-2015-007391 // 
            
            
            
            CNNVD: CNNVD-201605-127

EXTERNAL IDS
db:NVDid:CVE-2015-6023
Trust: 3.6
db:PACKETSTORMid:136901
Trust: 3.3
db:EXPLOIT-DBid:39762
Trust: 1.8
db:BIDid:96383
Trust: 1.5
db:JVNDBid:JVNDB-2015-007391
Trust: 0.8
db:CNNVDid:CNNVD-201605-127
Trust: 0.7
db:CNVDid:CNVD-2016-02892
Trust: 0.6
db:SEEBUGid:SSVID-91441
Trust: 0.1
db:VULHUBid:VHN-83984
Trust: 0.1
db:VULMONid:CVE-2015-6023
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-02892 // 
            
            
            
            VULHUB: VHN-83984 // 
            
            
            
            VULMON: CVE-2015-6023 // 
            
            
            
            BID: 96383 // 
            
            
            
            JVNDB: JVNDB-2015-007391 // 
            
            
            
            PACKETSTORM: 136901 // 
            
            
            
            CNNVD: CNNVD-201605-127 // 
            
            
            
            NVD: CVE-2015-6023

REFERENCES
url:http://packetstormsecurity.com/files/136901/netcommwireless-hspa-3g10wve-authentication-bypass-code-execution.html
Trust: 3.2
url:http://seclists.org/fulldisclosure/2016/may/18
Trust: 2.1
url:https://www.exploit-db.com/exploits/39762/
Trust: 1.9
url:http://seclists.org/fulldisclosure/2016/may/13
Trust: 1.8
url:http://www.securityfocus.com/bid/96383
Trust: 1.3
url:http://www.securityfocus.com/archive/1/538263/100/0/threaded
Trust: 1.2
url:http://www.securityfocus.com/archive/1/538297/100/0/threaded
Trust: 1.2
url:https://nvd.nist.gov/vuln/detail/cve-2015-6023
Trust: 0.9
url:http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2015-6023
Trust: 0.8
url:http://www.securityfocus.com/archive/1/archive/1/538297/100/0/threaded
Trust: 0.6
url:http://www.securityfocus.com/archive/1/archive/1/538263/100/0/threaded
Trust: 0.6
url:http://www.netcommwireless.com/
Trust: 0.3
url:https://cwe.mitre.org/data/definitions/284.html
Trust: 0.1
url:https://nvd.nist.gov
Trust: 0.1
url:https://www.helpag.com)
Trust: 0.1
url:https://www.youtube.com/watch?v=fs43mrg7rdk
Trust: 0.1
url:https://www.helpag.com
Trust: 0.1
url:http://www.etisalat.ae/nrd/en/generic/3.5g_router.jsp
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2015-6024
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2016-02892 // 
            
            
            
            VULHUB: VHN-83984 // 
            
            
            
            VULMON: CVE-2015-6023 // 
            
            
            
            BID: 96383 // 
            
            
            
            JVNDB: JVNDB-2015-007391 // 
            
            
            
            PACKETSTORM: 136901 // 
            
            
            
            CNNVD: CNNVD-201605-127 // 
            
            
            
            NVD: CVE-2015-6023

CREDITS
Bhadresh Patel.
Trust: 0.3
sources:
            
            
            BID: 96383

SOURCES
db:CNVDid:CNVD-2016-02892
db:VULHUBid:VHN-83984
db:VULMONid:CVE-2015-6023
db:BIDid:96383
db:JVNDBid:JVNDB-2015-007391
db:PACKETSTORMid:136901
db:CNNVDid:CNNVD-201605-127
db:NVDid:CVE-2015-6023

LAST UPDATE DATE
2025-04-20T23:20:06.742000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2016-02892date:2016-05-10T00:00:00
db:VULHUBid:VHN-83984date:2018-10-09T00:00:00
db:VULMONid:CVE-2015-6023date:2018-10-09T00:00:00
db:BIDid:96383date:2017-03-07T04:04:00
db:JVNDBid:JVNDB-2015-007391date:2017-03-30T00:00:00
db:CNNVDid:CNNVD-201605-127date:2017-02-10T00:00:00
db:NVDid:CVE-2015-6023date:2025-04-20T01:37:25.860

SOURCES RELEASE DATE
db:CNVDid:CNVD-2016-02892date:2016-05-10T00:00:00
db:VULHUBid:VHN-83984date:2017-02-09T00:00:00
db:VULMONid:CVE-2015-6023date:2017-02-09T00:00:00
db:BIDid:96383date:2017-02-09T00:00:00
db:JVNDBid:JVNDB-2015-007391date:2017-03-30T00:00:00
db:PACKETSTORMid:136901date:2016-05-03T23:16:49
db:CNNVDid:CNNVD-201605-127date:2016-05-05T00:00:00
db:NVDid:CVE-2015-6023date:2017-02-09T15:59:00.300