full-disclosure - [FD] Telus Actiontec WEB6000Q Serial Number Information Disclosure

Open Source and information security mailing list archives

Message-ID: <1f916c26-1637-04c0-d7df-7a23920c1477@aklaus.ca>
Date: Sun, 9 Jun 2019 12:34:26 -0600
From: Andrew Klaus <andrew@...aus.ca>
To: fulldisclosure@...lists.org
Subject: [FD] Telus Actiontec WEB6000Q Serial Number Information Disclosure

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

###  Device Details
Discovered By: Andrew Klaus (andrew@...aus.ca)
Vendor: Actiontec (Telus Branded, but may work on others)
Model: WEB6000Q
Affected Firmware: 1.1.02.22

Reported: Sept 2018
CVE:  Not needed since update is pushed by the provider.

### Summary of Findings

The wireless extenders use DHCP Option 125 to include device details
such as model number, manufacturer, and serial number.

The WCB6000Q DHCP DISCOVER and REQUEST broadcasts include the device
serial number in the DHCP option 125 (subopt 2) field. An attacker on
the same Layer 2 network segment as the device, can see all these DHCP
requests with a packet capture.

Once he or she has this, the device’s admin web UI password can be
reset using the web UI “forgot password” page to reset to a known value.

### Mitigation
Do not use the serial number to initiate password resets.

The serial number has other internal uses in the Web UI, which means
there’s a higher chance of it being leaked over the network. By using a
different value, this risk can be mitigated since the reset value is
only used for that purpose.

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives