Websec.ca - Information Security Solutions

Command Execution and Backdoor in Zhone GPON-2520

Thu, 18 Dec 2014 00:00:00 +0000

This post will describe a backdoor account found in the Zhone GPON-2520 and will provide a PoC which can be used to disable the firewall filtration rules in order to allow access to services such as ssh, telnet and ftp.

Huawei HG8245 / HG8247 WPA Generator

Thu, 22 May 2014 23:49:29 +0000

Huawei HG8245 & HG8247 ONT (firmware version V1R006C00S100) rely on a weak algorithm to calculate the WPA keys, keys can be predicted easily using the WiFi's MAC Address (BSSID).

Arbitrary Command Execution in Alcatel-Lucent I-240W-Q

Thu, 19 Dec 2013 16:54:48 +0000

The ONT Alcatel-Lucent I-240W-Q is vulnerable to arbitrary command execution in the administrative web interface.

Huawei HG8245 backdoor and remote access

Mon, 09 Dec 2013 21:21:57 +0000

The Huawei HG8245 ONT, firmware version V1R006C00S100 which provides cellular services, contains 3 severe vulnerabilities: two administrator accounts enabled by default and a public administration interface exposed to the Internet.

Multiple vulnerabilities in ZPanel 10.0.1

Fri, 18 Jan 2013 14:42:53 +0000

Several vulnerabilties were discovered in ZPanel 10.0.1 during our pro bono security audit. The ZPanel team has addressed these issues in version 10.0.2 and it is advised to upgrade.

Debugging shell with root privileges in routers TP-Link WR740

Mon, 18 Jun 2012 17:23:24 +0000

There is a hidden debugging shell with root privileges in routers TP-Link WR740.

Path traversal in TP-LINK WR740 and possibly others

Sun, 17 Jun 2012 10:46:45 +0000

TP-Link WR740 routers are vulnerable to a path traversal vulnerability on the web administration interface. Unauthenticated users are able to read any file from the device.

Huawei HG866 authentication bypass

Thu, 14 Jun 2012 13:20:50 +0000

The web management interface of Huawei HG688 routers has several pages which fail to validate the user's session. This allows an attacker to bypass the authentication both locally and remotely.

Netgear Information Disclosure

Sat, 26 May 2012 22:18:04 +0000

Several NETGEAR devices are vulnerable to information disclosure via the web interface.

PHP Self Cross Site Scripting in MantisBT 1.2.x

Tue, 13 Sep 2011 04:42:56 +0000

MantisBT installations 1.2.x up to 1.2.7 are vulnerable to Cross Site Scripting attacks due to lack of sanitation of the variable $_SERVER["PHP_SELF"]

Anti-CSRF Filter Bypass SMF 2.0 / 1.1.14

Tue, 23 Aug 2011 22:53:50 +0000

The [img] BBCode tag anti-CSRF filter can be bypassed due to incorrect parsing of the 'action' variable, because of this it is possible to execute CSRF successfully.

Huawei EchoLife HG520 Remote Management CSRF

Sat, 29 May 2010 17:22:53 +0000

Huawei EchoLife HG520 modems do not require authentication to access certain pages such as: '/Forms/access_cwmp_1', '/Forms/rpQos_1' and '/Forms/rpRManage_1'. A CSRF exploit can be used to enable remote administration inerfaces on the WAN.

Huawei EchoLife HG520c Information Disclosure

Sun, 16 May 2010 22:01:43 +0000

Huawei EchoLife HG520 modems are vulnerable to an information disclosure vulnerability. Sensitive modem information can be accessed using a public URL in modems with the web interface activated.

Huawei EchoLife HG520 Remote Information Disclosure

Thu, 13 May 2010 16:04:17 +0000

Huawei EchoLife HG520 modems are vulnerable to a remote information disclosure vulnerability. This vulnerability can be exploited by sending a specially crafted UDP packet that causes the modems to return sensitive information in clear text form.

Huawei EchoLife HG520c Denial of Service & Unauthorized Factory Reset

Thu, 13 May 2010 15:51:05 +0000

Huawei EchoLife HG520c modems are vulnerable to unauthorized device reset and denial of service vulnerabilities.

Croogo CMS 1.3 'Contact' and 'User' Module HTML Injection

Mon, 10 May 2010 10:24:41 +0000

Croogo CMS is prone to an HTML-injection vulnerability because it fails to properly sanitize user-supplied input.

Croogo CMS 1.2 Cross Site Scripting Vulnerabilities

Sat, 27 Feb 2010 21:23:35 +0000

Croogo CMS 1.2 Cross Site Scripting Vulnerabilities

OPENCONF CE 3.41 MULTIPLE XSS AND SQL

Thu, 26 Nov 2009 22:09:47 +0000

OpenConf CE 3.41 contains multiple Cross-site Scripting vulnerabilities and an SQL injection vulnerability.

ZenCart 1.3.8a Multiple XSS in Admin Interface

Mon, 16 Nov 2009 14:07:59 +0000

ZenCart 1.3.8a has a persistent XSS in 'Admin Home' in 'Last Name' parameter. Another Cross Site Scripting vulnerability exists in 'nogrants' parameter in sqlpatch.php.

D-Link WBR-1310 Cross-Site Scripting

Sun, 15 Nov 2009 17:09:43 +0000

D-Link WBR-1310 Router is susceptible to XSS, allowing an attacker to change the Admins password...

2Wire Remote Denial of Service

Sun, 01 Nov 2009 13:03:14 +0000

The remote management interface on tcp/50001 of various 2Wire devices suffer from a remote denial of service vulnerability.

Commonspot CMS 5.1.0.x Cross Site Scripting vulnerabilities

Tue, 13 Oct 2009 17:29:24 +0000

XSS vulnerabilities in Commonspot CMS

2Wire Authentication Bypass and Unauthorized Password Reset

Mon, 12 Oct 2009 15:26:39 +0000

Some 2Wire devices are vulnerable to authentication bypass and remote password reset attacks that allow drive by pharming.