full-disclosure - [FD] Telus Actiontec T2200H Serial Number Information Disclosure

Open Source and information security mailing list archives

Message-ID: <cb2de2dd-6cae-8a78-64df-a37d51679940@aklaus.ca>
Date: Sun, 9 Jun 2019 12:30:46 -0600
From: Andrew Klaus <andrew@...aus.ca>
To: fulldisclosure@...lists.org
Subject: [FD] Telus Actiontec T2200H Serial Number Information Disclosure

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

###  Device Details
Vendor: Actiontec (Telus Branded, but may work on others)
Model: T2200H
Affected Firmware: T2200H-31.128L.08
Device Manual:
http://static.telus.com/common/cms/files/internet/telus_t2200h_user_manu
al.pdf

Reported: Sept 2018
CVE:  Not needed since update is pushed by the provider.

The Telus Actiontec T2200H is bonded VDSL2 modem. It
incorporates 2 VDSL2 bonded links with a built-in firewall, bridge mode,
802.11agn wireless, etc.

###   Summary of Findings
The wireless extenders use DHCP Option 125 to include device details
such as model number, manufacturer, and serial number.  By forging a
special DHCP packet using Option 125, an attacker can obtain the device
serial number.

Once he or she has this, the device’s admin web UI password can be reset
using the web UI “forgot password” page to reset to a known value.

###   Mitigation
Do not use the serial number to initiate password resets.

The serial number has other internal uses in the Web UI, which means
there’s a higher chance of it being leaked inadvertently over the
network. By using a different value, this risk can be mitigated since
the reset value is only used for that purpose.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives