{"id":6273,"date":"2017-01-23T14:07:53","date_gmt":"2017-01-23T22:07:53","guid":{"rendered":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-124\/"},"modified":"2017-01-23T14:07:53","modified_gmt":"2017-01-23T22:07:53","slug":"news-124","status":"publish","type":"post","link":"http:\/\/www.palada.net\/index.php\/2017\/01\/23\/news-124\/","title":{"rendered":"SSD Advisory – ZyXEL \/ Billion Multiple Vulnerabilities"},"content":{"rendered":"
\n

Vulnerability Summary<\/strong>
The following advisory describes four (4) vulnerabilities and default accounts \/ passwords in ZyXEL \/ Billion customized routers.<\/p>\n

TrueOnline is a major Internet Service Provider in Thailand that provides customized versions of routers to its customers, free of charge.<\/p>\n

The routers are manufactured by ZyXEL and Billion runs a special Linux distribution called “tclinux”. Several models are distributed by TrueOnline, three in particular are widespread:<\/p>\n

    \n
  1. ZyXEL P660HN-T v1 (distributed up to 2013)<\/li>\n
  2. ZyXEL P660HN-T v2<\/li>\n
  3. Billion 5200W-T (currently being distributed to new clients)<\/li>\n<\/ol>\n

    These are customized versions of existing ZyXEL and Billion routers. They are MIPS systems and they all run BOA web server. The routers are vulnerable via command injections in its web interface, which can be exploited by an unauthenticated as well as an authenticated attacker. Furthermore, the routers includes several hardcoded accounts besides the usual administrator account.<\/p>\n

    The four vulnerabilities found in ZyXEL \/ Billion routers:<\/p>\n

      \n
    1. Unauthenticated remote command execution vulnerability – P660HN-T v1 router<\/li>\n
    2. Unauthenticated remote command execution vulnerability – Billion 5200W-T<\/li>\n
    3. Authenticated remote command execution vulnerability – Billion 5200W-T<\/li>\n
    4. Unauthenticated remote command execution vulnerability – P660HN-T v2<\/li>\n<\/ol>\n

      Default accounts and passwords:<\/p>\n

        \n
      1. Default accounts- P660HN-T v1 router<\/li>\n
      2. Default accounts – P660HN-T v2<\/li>\n
      3. Default accounts \u2013 Billion 5200W-T router<\/li>\n<\/ol>\n

        Credit<\/strong>
        Pedro Ribeiro (pedrib@gmail.com) has reported this vulnerability to Beyond Security\u2019s SecuriTeam Secure Disclosure program.<\/p>\n

        <\/span><\/p>\n

        Unauthenticated remote command execution vulnerability – P660HN-T v1 router<\/strong>
        The P660HN-T v1 router has a command injection vulnerability in Maintenance > Logs > System Log > Remote System Log
        Remote host: ;command;#<\/em><\/p>\n

        The vulnerability is can be found in the ViewLog.asp<\/em> page, which is accessible unauthenticated.<\/p>\n<\/p>\n

        \t\t<\/p>\n

        \n
        <\/span> \t\t\t<\/p>\n
        \n
        \n
        <\/div>\n<\/div>\n
        \n
        <\/div>\n<\/div>\n
        \n
        <\/div>\n<\/div>\n
        \n
        <\/div>\n<\/div>\n
        \n
        <\/div>\n<\/div>\n
        \n
        <\/div>\n<\/div>\n<\/div>\n<\/div>\n
        <\/div>\n