Novatel Wireless MiFi 2352 Password Information Disclosure Vulnerability

Bugtraq ID:	37962
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Jan 17 2010 12:00AM
Updated:	Mar 09 2011 03:17PM
Credit:	Alejandro Ramos
Vulnerable:	Novatel Wireless MiFi 2352 Access Point Firmware 11.47.17 Novatel Wireless MiFi 2200 Access Point Firmware 11.47.17
Not Vulnerable:

Novatel Wireless MiFi 2352 Password Information Disclosure Vulnerability

MiFi 2352 is prone to an information-disclosure vulnerability that may expose sensitive information.

Successful exploits will allow authenticated attackers to obtain passwords, which may aid in further attacks.

MiFi 2352 access point firmware 11.47.17 is vulnerable; other versions may also be affected.

Novatel Wireless MiFi 2352 Password Information Disclosure Vulnerability

Attackers can exploit this issue via a browser.

The following example URIs are available:

http://www.example.com/config.xml.sav
http://www.example.com/config.xml.save

Novatel Wireless MiFi 2352 Password Information Disclosure Vulnerability

Solution:
Currently we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of any recent information, please mail us at: [email protected].

Novatel Wireless MiFi 2352 Password Information Disclosure Vulnerability

References:

• Novatel Wireless Homepage (Novatel Wireless)
  
• Vulnerability in modem / router 3G wireless - Novatel MiFi 2352 (Alejandro Ramos)