exploit the possibilities

NEC Aterm WG2600HP2 Information Disclosure

NEC Aterm WG2600HP2 Information Disclosure
Posted Aug 23, 2018
Authored by Kenney Lu

NEC Aterm WG2600HP2 suffers from an information disclosure vulnerability due to missing authentication.

tags | exploit, info disclosure
advisories | CVE-2017-12575
MD5 | a5b590d3a117f54d14e10d792ae90024

NEC Aterm WG2600HP2 Information Disclosure

Change Mirror Download
Reserved CVE: CVE-2017-12575

# Description
The router has a set of web service APIs for access to and setup of the configuration. Some of APIs don't require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmware version, and network status.

# Vulnerability Type
Incorrect Access Control

# Affected Product Code Base]
Aterm WG2600HP2 - 1.0.2

# Affected Component
The built-in web service APIs

# Attack Type
Remote

# Attack Vectors
Send a crafted POST HTTP request to access their APIs

# Discoverer
Kenney Lu (Trend Micro)

# Vulnerability Detail
The router has a set of web service APIs which provide user to access and setup configuration, some APIs donat require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmware version, or network status.

> List all available commands
ex: curl -X http://[IP]/aterm_httpif.cgi/negotiate -d aREQ_ID=SUPPORT_IF_GET"



<table class="TM_EMAIL_NOTICE"><tr><td><pre>
TREND MICRO EMAIL NOTICE
The information contained in this email and any attachments is confidential
and may be subject to copyright or other intellectual property protection.
If you are not the intended recipient, you are not authorized to use or
disclose this information, and we request that you notify us by reply mail or
telephone and delete the original message from your mail system.
</pre></td></tr></table>


Login or Register to add favorites

File Archive:

October 2020

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Oct 1st
    25 Files
  • 2
    Oct 2nd
    13 Files
  • 3
    Oct 3rd
    1 Files
  • 4
    Oct 4th
    1 Files
  • 5
    Oct 5th
    15 Files
  • 6
    Oct 6th
    15 Files
  • 7
    Oct 7th
    15 Files
  • 8
    Oct 8th
    11 Files
  • 9
    Oct 9th
    3 Files
  • 10
    Oct 10th
    1 Files
  • 11
    Oct 11th
    1 Files
  • 12
    Oct 12th
    8 Files
  • 13
    Oct 13th
    12 Files
  • 14
    Oct 14th
    23 Files
  • 15
    Oct 15th
    4 Files
  • 16
    Oct 16th
    13 Files
  • 17
    Oct 17th
    1 Files
  • 18
    Oct 18th
    1 Files
  • 19
    Oct 19th
    27 Files
  • 20
    Oct 20th
    0 Files
  • 21
    Oct 21st
    0 Files
  • 22
    Oct 22nd
    0 Files
  • 23
    Oct 23rd
    0 Files
  • 24
    Oct 24th
    0 Files
  • 25
    Oct 25th
    0 Files
  • 26
    Oct 26th
    0 Files
  • 27
    Oct 27th
    0 Files
  • 28
    Oct 28th
    0 Files
  • 29
    Oct 29th
    0 Files
  • 30
    Oct 30th
    0 Files
  • 31
    Oct 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close