2Wire Authentication Bypass and Unauthorized Password Reset

Advisory

Application	2Wire Gateway
Impact	Authentication bypass and unauthorized password reset
Websec Advisory	WS09-02
Disclosed	August 4, 2009
Venue	DEF CON 17

Description

There is an authentication bypass vulnerability in page=CD35_SETUP_01 that allows an attacker to set a new administrative password even when one is already configured, without knowing the existing password.

Additionally, submitting the same form with a password longer than 512 characters causes the password field to be wiped. The next time the router is accessed, the user is prompted to set a new password, granting the attacker an opportunity to take over the device on refresh.

Affected Products

• 2Wire 2071 Gateway — firmware 5.29.51
• 2Wire 1800HW — firmware 3.17.5
• 2Wire 1701HG — firmware 3.7.1

Fixed In

Firmware 5.29.135.5 or later.

Disclosure Timeline

• 2009-03-27 — 2Wire contacted, no satisfactory response.
• 2009-07-11 — Complete technical details sent to 2Wire, no response.
• 2009-07-17 — Advisory and video demos sent to 2Wire; ticket escalated, no further response.
• 2009-08-02 — Publicly disclosed at DEF CON 17.

Exploit / Proof of Concept

Authentication Bypass. Request the setup page directly to set a new password, bypassing the existing credential check:

http://gateway.2wire.net/xslt?page=CD35_SETUP_01

Password Reset. Submit the same form with a password longer than 512 characters; the stored password is cleared on the next access:

http://gateway.2wire.net/xslt?PAGE=CD35_SETUP_01_POST&password1=<513+chars>&password2=<513+chars>