Thomson TCW690 POST Password Validation Vulnerability

[MurDoK <murdok.lnx () gmail com>]

I found a vulnerability in this cablemodem which a malicious user inside *LAN 
can get the control of the cablemodem easily. 
This cablemodem model is given by the spanish ISP "AUNA".
 
Details 
======= 
 
Product: Thomson TCW690 cablemodem 
Affected Version: ST42.03.0a (not tested in minor versions)
Immune Version: ??? 
Security-Risk: high 
Exploit: yes 
Product-URL: 
http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?category=cab%20modem%20Eurodocsis&model=TCW690 
Vendor-URL: http://www.thomson.net/ 
Vendor-Status: informed but no response 
 
Description 
=========== 
 
The http server inside this cablemodem doesn't properly validate the supplied 
password when an user want to do some change in the configuration and sends a 
POST request. In the exploit I show how to change the admin password but you 
can also open ports, deny a user access, restore factory defaults, (all)... 
with a little changes. 
 
Exploit 
======= 
 
Attached. 
 
Fix 
=== 
 
No response from vendor. There isn't fix available.  
 
Vendor Status 
============== 
2005.02.06 - Bug found. 
2005.02.07 - Informed the vendor broadband () thomson net, no response. 
2005.02.11 - Informed the vendor webmaster () thomson net no response too. 
2005.02.19 - Public disclosure.

Attachment: mdk_tcw690.c
Description: