Full Disclosure mailing list archives
Thomson TCW690 POST Password Validation Vulnerability
From: MurDoK <murdok.lnx () gmail com>
Date: Sat, 19 Feb 2005 10:41:45 +0100
I found a vulnerability in this cablemodem which a malicious user inside *LAN can get the control of the cablemodem easily. This cablemodem model is given by the spanish ISP "AUNA". Details ======= Product: Thomson TCW690 cablemodem Affected Version: ST42.03.0a (not tested in minor versions) Immune Version: ??? Security-Risk: high Exploit: yes Product-URL: http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?category=cab%20modem%20Eurodocsis&model=TCW690 Vendor-URL: http://www.thomson.net/ Vendor-Status: informed but no response Description =========== The http server inside this cablemodem doesn't properly validate the supplied password when an user want to do some change in the configuration and sends a POST request. In the exploit I show how to change the admin password but you can also open ports, deny a user access, restore factory defaults, (all)... with a little changes. Exploit ======= Attached. Fix === No response from vendor. There isn't fix available. Vendor Status ============== 2005.02.06 - Bug found. 2005.02.07 - Informed the vendor broadband () thomson net, no response. 2005.02.11 - Informed the vendor webmaster () thomson net no response too. 2005.02.19 - Public disclosure.
Attachment:
mdk_tcw690.c
Description:
_______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.netsys.com/full-disclosure-charter.html
Current thread:
- Thomson TCW690 POST Password Validation Vulnerability MurDoK (Feb 19)