FiberHome MIFI LM53Q1 Multiple Vulnerabilities

[Ibad Shah <muhammad.ibad.shah () gmail com>]

SUMMARY


FiberHome Suffers from improper permission handling resulting in modification

of password, exposing sensitive details by unauthorized access.

DETAILS

The portal on FiberHome Mobile WIFI Device Model LM53Q1 VH519R05C01S38
uses SOAP based web services in order to interact with the portal.

Unauthorized Access to Web Services can result disclosure of sensitive
information for example users connected to the device,

Username & Password of Portal & vice versa.The Password or
Administrator ID of Portal can also

be changed via  crafted web service call due to unauthorized access to
web service.



REFERENCES


CVE-2017-16885, CVE-2017-16886, CVE-2017-16887


Credits


Taimoor Zafar, Aitezaz Mohsin, Jawad Ahmed

_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/