Multiple Vulnerabilities in TERACOM ROUTER

#Author: Ajay Gowtham aka AJOXR
#Contact: gowtham.ajay5 at gmail.com
#Vulnerability Type: Insecure Upload File Permissions
#Affected Module: Upload Functionality
#Criticality: Medium
#Device Model: BSNL Teracom T2-B-Gawv1.4U10Y-BI is WiFi enabled ADSL2+
compliant + WiFi
#Firmware: 10.4.3.12.12
----------------------------------------------------------------------------------------------
Firmware Re-write using Unrestricted Upload of File (Insecure File Contents)

Reference ID: CWE - 434
CVE - ID :  CVE-2015-2049, CVE-2015-2876

Ref: https://cwe.mitre.org/data/definitions/434.html

Description: Teracom T2-B-Gawv1.4u10Y-BI Models are having clear type text
contents in Upload
File in Restore Configuration. After Modifying file uploaded malicious
scripts will be executed
in Firmware of the affected model. Which will allow an attacker to carry
out Arbitary Code
Execution.

Reproduce Vulnerability:

Step 1: Go to Admin Pannel, you can find Backup file options to backup
config.
Step 2: Modify Config file Conexant.icf with malicious commands using Text
Editor
Step 3: Re-upload to the device using restore options
Step 4: Router will restart and executes the malicious commands into router.
Step 5: User will be using Malicious Router without concern as it will
remain undetected also in
antivirus.

Solution: An update will be solution.
----------------------------------------------------------------------------------------------
Management Server Link Access to External Resource

Reference ID: CWE - 610
CVE - ID: CVE-2016-0071

Ref: https://cwe.mitre.org/data/definitions/610.html

Description: Teracom T2-B-Gawv1.4u10Y-BI Models accepting link
modifications as no Hard-coded
is provided in Management Server Module. Any User is able to change with
default credentials.

Step 1: Re-write the link in Management Server Module.
Step 2: Apply necessary changes with malicious link.
Step 3: Re-start the server and changes are made.

Solution: Hard code the link parameter to avoid adding external resource
link to the Router.
----------------------------------------------------------------------------------------------

PoC :
https://drive.google.com/folderview?id=0B2p8gG1WpnRnek9GaEl3SXVod3c&usp=sharing