what you don't know can hurt you
Home Files News &[SERVICES_TAB]About Contact Add New

DASAN H660RM Information Disclosure / Hardcoded Key

DASAN H660RM Information Disclosure / Hardcoded Key
Posted Mar 26, 2019
Authored by Krzysztof Burghardt

DASAN H660RM allows for unauthenticated ping access, has a hardcoded key for encryption, and logs sensitive information into /tmp.

tags | exploit, bypass, info disclosure
advisories | CVE-2019-9974, CVE-2019-9975, CVE-2019-9976
SHA-256 | de1439ba49e2762cb6f57ff0e775a7b05e70db3ea5a1aa4a0759ccc8915120d4

DASAN H660RM Information Disclosure / Hardcoded Key

Change Mirror Download
Hi!

CVE-2019-9974: diag_tool.cgi on DASAN H660RM devices with firmware
1.03-0022 allows spawning ping processes without any authorization
leading to information disclosure and DoS attacks

Remote attacker could enumerate hosts on LAN interface sending
requests to /cgi-bin/diag_tool.cgi with ip parameter set to target IP
address. Lack of authorization in /cgi-bin/diag_get_result.cgi allow
retrieval of results. Each call to diag_get_result.cgi retrieves one
line of ping (or traceroute) output.

Same CGI script has another weakness, CWE-400: Uncontrolled Resource
Consumption, which allows memory memory exhaustion Denial of Service
(DoS) attack against device. Around 170 spawned ping processes is
enough to cause crash and reboot of router. PoC exploit available.

More: https://blog.burghardt.pl/2019/03/diag_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-allows-spawning-ping-processes-without-any-authorization-leading-to-information-disclosure-and-dos-attacks/


CVE-2019-9975: syslog_tool.cgi on DASAN H660RM devices with firmware
1.03-0022 uses a hard-coded key for logs encryption

DASAN uses a hard-coded key “dasanektks123” for logs encryption. Data
stored using this key can be decrypted by anyone able to access this
key.

More: https://blog.burghardt.pl/2019/03/syslog_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-uses-a-hard-coded-key-for-logs-encryption/


CVE-2019-9976: Boa Webserver on DASAN H660RM devices with firmware
1.03-0022 saves post data, including credentials, to /tmp/boa-temp

Exploitation is possible for users logged in over telnet of SSH. If
user logged though Web UI and until he make any other POST request,
his credentials can be retrieved with:

$ cat /tmp/boa-temp
StatusActionFlag=-1&Username=admin&Password=vertex25

More: https://blog.burghardt.pl/2019/03/boa-webserver-on-dasan-h660rm-devices-with-firmware-1-03-0022-saves-post-data-including-credentials-to-tmp-boa-temp/

BR,
--
Krzysztof Burghardt <krzysztof@burghardt.pl>
http://www.burghardt.pl/

Login or Register to add favorites

File Archive:

June 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jun 1st
    0 Files
  • 2
    Jun 2nd
    0 Files
  • 3
    Jun 3rd
    18 Files
  • 4
    Jun 4th
    21 Files
  • 5
    Jun 5th
    0 Files
  • 6
    Jun 6th
    57 Files
  • 7
    Jun 7th
    6 Files
  • 8
    Jun 8th
    0 Files
  • 9
    Jun 9th
    0 Files
  • 10
    Jun 10th
    12 Files
  • 11
    Jun 11th
    27 Files
  • 12
    Jun 12th
    38 Files
  • 13
    Jun 13th
    16 Files
  • 14
    Jun 14th
    14 Files
  • 15
    Jun 15th
    0 Files
  • 16
    Jun 16th
    0 Files
  • 17
    Jun 17th
    0 Files
  • 18
    Jun 18th
    0 Files
  • 19
    Jun 19th
    0 Files
  • 20
    Jun 20th
    0 Files
  • 21
    Jun 21st
    0 Files
  • 22
    Jun 22nd
    0 Files
  • 23
    Jun 23rd
    0 Files
  • 24
    Jun 24th
    0 Files
  • 25
    Jun 25th
    0 Files
  • 26
    Jun 26th
    0 Files
  • 27
    Jun 27th
    0 Files
  • 28
    Jun 28th
    0 Files
  • 29
    Jun 29th
    0 Files
  • 30
    Jun 30th
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close