Belkin Wireless G Plus MIMO Router F5D9230-4 Authentication Bypass Vulnerability

2008.01.23
Credit: darkfig
Risk: Medium
Local: Yes
Remote: Yes
CWE: CWE-287


CVSS Base Score: 5.5/10
Impact Subscore: 4.9/10
Exploitability Subscore: 8/10
Exploit range: Remote
Attack complexity: Low
Authentication: Single time
Confidentiality impact: Partial
Integrity impact: Partial
Availability impact: None

## ## VULNERABILITY: ## ## Belkin Wireless G Plus MIMO Router F5D9230-4 ## Authentication Bypass Vulnerability ## ## ## AUTHOR: ## ## DarkFig < gmdarkfig (at) gmail (dot) com > ## http://acid-root.new.fr/?0:17 ## #acidroot (at) irc.wordlnet (dot) com [email concealed] ## ## ## INTRODUCTION: ## ## I recently bought this router for my local ## network (without modem integrated), now I can tell ## that it was a bad choice. When my ISP disconnects ## me from internet, in the most case I have to reboot ## my Modem and the Router in order to reconnect. ## So I coded a program (which send http packets) to reboot ## my router, it asks me the router password, and reboots it. ## One day I wrote a bad password, but it worked. So I ## decided to make some tests in order to see if there was ## a vulnerability. ## ## ## DESCRIPTION: ## ## Apparently when we the router starts, it create a file ## (without content) named user.conf, then when we go to ## SaveCfgFile.cgi, the configuration is save to the file ## user.conf. But the problem is that we can access ## (and also change) to the file SaveCfgFile.cgi without ## login. ## ## ## PROOF OF CONCEPT: ## ## For example we can get the configuration file here: ## http://<ROUTER_IP>/SaveCfgFile.cgi ## ## pppoe_username=... ## pppoe_password=... ## wl0_pskkey=... ## wl0_key1=... ## mradius_password=... ## mradius_secret=... ## httpd_password=... ## http_passwd=... ## pppoe_passwd=... ## ## ## Tested on the latest firmware for this product ## (version 3.01.53). ## ## ## PATCH ## ## Actually there is no firmware update, but I contacted the ## author, if they'll release a patch, it will be available here: ## http://web.belkin.com/support/download/download.asp ## ?download=F5D9230-4&lang=1&mode= ##


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2019, cxsecurity.com

 

Back to Top