From: MurDoK (murdok.lnxgmail.com)
Date: Sat Feb 19 2005 - 03:41:45 CST

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]

I found a vulnerability in this cablemodem which a malicious user inside *LAN
can get the control of the cablemodem easily.
This cablemodem model is given by the spanish ISP "AUNA".
 
Details
=======
 
Product: Thomson TCW690 cablemodem
Affected Version: ST42.03.0a (not tested in minor versions)
Immune Version: ???
Security-Risk: high
Exploit: yes
Product-URL:
http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?category=cab%20modem%20Eurodocsis&model=TCW690
Vendor-URL: http://www.thomson.net/
Vendor-Status: informed but no response
 
Description
===========
 
The http server inside this cablemodem doesn't properly validate the supplied
password when an user want to do some change in the configuration and sends a
POST request. In the exploit I show how to change the admin password but you
can also open ports, deny a user access, restore factory defaults, (all)...
with a little changes.
 
Exploit
=======
 
Attached.
 
Fix
===
 
No response from vendor. There isn't fix available.
 
Vendor Status
==============
2005.02.06 - Bug found.
2005.02.07 - Informed the vendor broadbandthomson.net, no response.
2005.02.11 - Informed the vendor webmasterthomson.net no response too.
2005.02.19 - Public disclosure.

• text/x-csrc attachment: mdk_tcw690.c

• Messages sorted by: [ date ] [ thread ] [ subject ] [ author ]