ZyXEL Prestige Router HTTP Remote Administration Configuration Reset Vulnerability

Bugtraq ID:	11723
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Nov 22 2004 12:00AM
Updated:	Nov 22 2004 12:00AM
Credit:	Discovery of this vulnerability is credited to Francisco "José" Canela <[email protected]>.
Vulnerable:	ZyXEL ZyNOS 3.40 ZyXEL ZyNOS V3.40(ES.5) + ZyXEL Prestige 650R-11 ZyXEL ZyNOS IS.5 ZyXEL ZyNOS IS.3 ZyXEL Prestige 650R ZyXEL Prestige 650HW-31 ZyXEL Prestige 650HW ZyXEL Prestige 650H ZyXEL Prestige 645R-A1
Not Vulnerable:	ZyXEL Prestige 782R

ZyXEL Prestige Router HTTP Remote Administration Configuration Reset Vulnerability

ZyXEL Prestige router series is reported prone to an access validation vulnerability. The vulnerability exists because the firmware of the router fails to restrict access to a configuration page that is a part of the ZyXEL Prestige HTTP based remote administration service.

A remote attacker may exploit this vulnerability to reset the configuration of the router.

ZyXEL Prestige Router HTTP Remote Administration Configuration Reset Vulnerability

The following example is available:

http://www.example.com/rpFWUpload.html

ZyXEL Prestige Router HTTP Remote Administration Configuration Reset Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches for this issue. If you feel we are in error or are aware of more recent information, please mail us at: [email protected] <mailto:[email protected]>.

ZyXEL Prestige Router HTTP Remote Administration Configuration Reset Vulnerability

References:

• ZyXEL Total Internet Access Solution (ZyXEL)
  
• Re: Router ZyXEL Prestige 650 HW http remote admin. (Laurent Papier )
  
• Router ZyXEL Prestige 650 HW http remote admin. (Francisco "José" Canela )