lists  /  announce  owl-users  owl-dev  john-users  john-dev  passwdqc-users  yescrypt  popa3d-users  /  oss-security  kernel-hardening  musl  sabotage  tlsify  passwords  /  crypt-dev  xvendor  /  Bugtraq  Full-Disclosure  linux-kernel  linux-netdev  linux-ext4  linux-hardening  PHC 
Open Source and information security mailing list archives
Hash Suite: Windows password security audit tool. GUI, reports in PDF.
[<prev] [next>] [day] [month] [year] [list]
Date: Mon, 25 Mar 2019 14:29:25 +0100
From: Krzysztof Burghardt <>
Subject: Multiple vulnerabilities in DASAN H660RM GPON router firmware


CVE-2019-9974: diag_tool.cgi on DASAN H660RM devices with firmware
1.03-0022 allows spawning ping processes without any authorization
leading to information disclosure and DoS attacks

Remote attacker could enumerate hosts on LAN interface sending
requests to /cgi-bin/diag_tool.cgi with ip parameter set to target IP
address. Lack of authorization in /cgi-bin/diag_get_result.cgi allow
retrieval of results. Each call to diag_get_result.cgi retrieves one
line of ping (or traceroute) output.

Same CGI script has another weakness, CWE-400: Uncontrolled Resource
Consumption, which allows memory memory exhaustion Denial of Service
(DoS) attack against device. Around 170 spawned ping processes is
enough to cause crash and reboot of router. PoC exploit available.


CVE-2019-9975: syslog_tool.cgi on DASAN H660RM devices with firmware
1.03-0022 uses a hard-coded key for logs encryption

DASAN uses a hard-coded key “dasanektks123” for logs encryption. Data
stored using this key can be decrypted by anyone able to access this


CVE-2019-9976: Boa Webserver on DASAN H660RM devices with firmware
1.03-0022 saves post data, including credentials, to /tmp/boa-temp

Exploitation is possible for users logged in over telnet of SSH. If
user logged though Web UI and until he make any other POST request,
his credentials can be retrieved with:

$ cat /tmp/boa-temp


Krzysztof Burghardt <>

Powered by blists - more mailing lists