ZTE ZXDSL 831CII Improper Access Restrictions

2017.11.28
Credit: Ibad Shah
Risk: Medium
Local: No
Remote: Yes
CWE: N/A

# Exploit Title: ZTE ZXDSL 831 Unauthorized Configuration Access # Date: 27/11/2017 # Exploit Author: Ibad Shah # Vendor Homepage: zte.com.cn # Software Link: - # Version: - ZXDSL - 831CII # Tested on: Windows 10 # CVE :- 2017-16953 ======================================= The Router usually servers html files & are protected with HTTP Basic Authentication. However, the CGI files does not protect this file from getting exposed to public. A Simple GET request would be needed to made to router that would give a remote attacker an opportunity to modify router PPPoE configurations, setup malicious configurations which later could lead to disrupt network & its activities. Proof Of Concept ================ http://192.168.1.1/connoppp.cgi


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2017, cxsecurity.com

 

Back to Top