Multiple DSL Routers CVE-2014-0329 Hardcoded Credentials Security Bypass Vulnerability

Bugtraq ID:	65310
Class:	Design Error
CVE:	CVE-2014-0329
Remote:	Yes
Local:	No
Published:	Feb 03 2014 12:00AM
Updated:	Nov 03 2015 07:21PM
Credit:	Cesar Neira
Vulnerable:	ZTE ZXV10 W300 2.1 Philippine Long Distance Telephone SpeedSurf 504AN Observa Telecom RTA01N 0 Digicom DG-5524T 0 Asus DSL-N12E 0
Not Vulnerable:

Multiple DSL Routers CVE-2014-0329 Hardcoded Credentials Security Bypass Vulnerability

Multiple DSL Routers are prone to a security-bypass vulnerability.

Attackers can exploit this issue to bypass the authentication mechanism and gain access to the vulnerable device.

Multiple DSL Routers CVE-2014-0329 Hardcoded Credentials Security Bypass Vulnerability

The following exploit is available:

• /data/vulnerabilities/exploits/65310.rb

Multiple DSL Routers CVE-2014-0329 Hardcoded Credentials Security Bypass Vulnerability

References:

• ZTE ZXV10 W300 Homepage (ZTE)
  
• Philippine Long Distance Telephone SpeedSurf 504AN and Kasda KW58293 contain mul (KB-CERT)
  
• VU#228886 ZTE ZXV10 W300 router contains hardcoded credentials (US-CERT)
  
• Vulnerability Note VU#950576: DSL routers contain hard-coded "XXXXairocon" crede (CERT)