full-disclosure - [FD] FiberHome MIFI LM53Q1 Multiple Vulnerabilities

Open Source and information security mailing list archives

Message-ID: <CADr9vUY+zrCe=9KDKGbuUQd98eEwz134UNtJX1BhQ_0RymHXfg@mail.gmail.com>
Date: Sun, 7 Jan 2018 03:15:38 +0500
From: Ibad Shah <muhammad.ibad.shah@...il.com>
To: fulldisclosure@...lists.org
Subject: [FD] FiberHome MIFI LM53Q1 Multiple Vulnerabilities

SUMMARY

FiberHome Suffers from improper permission handling resulting in modification

of password, exposing sensitive details by unauthorized access.

DETAILS

The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38
uses SOAP based web services in order to interact with the portal.

Unauthorized Access to Web Services can result disclosure of sensitive
information for example users connected to the device,

Username & Password of Portal & vice versa.The Password or
Administrator ID of Portal can also

be changed via  crafted web service call due to unauthorized access to
web service.

REFERENCES

CVE-2017-16885, CVE-2017-16886, CVE-2017-16887

Credits

Taimoor Zafar, Aitezaz Mohsin, Jawad Ahmed

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives