{"vuid":"VU#350135","idnumber":"350135","name":"Various WiMAX routers contain a authentication bypass vulnerability in custom libmtk httpd plugin","keywords":["authentication","bypass"],"overview":"WiMAX routers from several vendors making use of a custom httpd plugin for libmtk are vulnerable to an authentication bypass allowing a remote, unauthenticated attacker to change the administrator password on the device.","clean_desc":"CWE-306: Missing Authentication for Critical Function - CVE-2017-3216 Several WiMAX routers making use of a custom httpd plugin for libmtk (the MediaTek SDK library) are vulnerable to an authentication bypass that allows a remote, unauthenticated attacker to change the administrator password on the device. By sending a crafted POST request to commit2.cgi, an unauthenticated, remote attacker may reset the administrator password by sending a new password in the POST ADMIN_PASSWD variable. The reporter has identified the following model routers as being impacted; other models and firmware versions may also be impacted. The reporter notes that some devices have remote administration enabled by default, allowing an internet-based attacker to attempt this exploit. GreenPacket OX350 (Version: ?)\nGreenPacket OX-350 (Version: ?)\nHuawei BM2022 (Version: v2.10.14)\nHuawei HES-309M (Version: ?)\nHuawei HES-319M (Version: ?)\nHuawei HES-319M2W (Version: ?)\nHuawei HES-339M (Version: ?)\nMADA Soho Wireless Router (Version: v2.10.13)\nZTE OX-330P (Version: ?)\nZyXEL MAX218M (Version: 2.00(UXG.0)D0)\nZyXEL MAX218M1W (Version: 2.00(UXE.3)D0)\nZyXEL MAX218MW (Version: 2.00(UXD.2)D0)\nZyXEL MAX308M (Version: 2.00(UUA.3)D0)\nZyXEL MAX318M (Version: ?)\nZyXEL MAX338M (Version: ?) The MediaTek SDK for device firmware may be customized by downstream vendors. According to MediaTek, the MediaTek SDK does not contain the vulnerable files and so the vulnerability was introduced downstream from the SDK. It is currently unclear at what point in the supply chain this vulnerability was introduced. For more information, please see the researcher's blog post.","impact":"A remote, unauthenticated attacker may gain administrator access to the device after changing the administrator password on the device with a crafted POST request.","resolution":"The CERT/CC is currently unaware of a practical solution to this problem. Consider the following workarounds instead.","workarounds":"Restrict network access Restrict network access to the the router web interface to only trusted clients. Disable WAN device management Restrict network access to the router web interface from external connections.","sysaffected":"","thanks":"Thanks to Stefan Viehböck, SEC Consult Vulnerability Lab, for reporting this vulnerability.","author":"This document was written by Garret Wassermann.","public":["https://sec-consult.com/fxdata/seccons/prod/temedia/advisories_txt/20170607-0_Various_WiMAX_CPEs_Authentication_Bypass_v10.txt","http://blog.sec-consult.com/2017/06/ghosts-from-past-authentication-bypass.html","http://cwe.mitre.org/data/definitions/306.html"],"cveids":["CVE-2017-3216"],"certadvisory":"","uscerttechnicalalert":null,"datecreated":"2017-04-06T21:11:36Z","publicdate":"2017-06-07T00:00:00Z","datefirstpublished":"2017-06-07T15:04:51Z","dateupdated":"2017-07-24T16:14:57Z","revision":56,"vrda_d1_directreport":"1","vrda_d1_population":"2","vrda_d1_impact":"2","cam_widelyknown":"0","cam_exploitation":"0","cam_internetinfrastructure":"0","cam_population":"0","cam_impact":"0","cam_easeofexploitation":"0","cam_attackeraccessrequired":"0","cam_scorecurrent":"0","cam_scorecurrentwidelyknown":"0","cam_scorecurrentwidelyknownexploited":"0","ipprotocol":"","cvss_accessvector":"N","cvss_accesscomplexity":"L","cvss_authentication":null,"cvss_confidentialityimpact":"C","cvss_integrityimpact":"C","cvss_availabilityimpact":"C","cvss_exploitablity":null,"cvss_remediationlevel":"U","cvss_reportconfidence":"C","cvss_collateraldamagepotential":"ND","cvss_targetdistribution":"M","cvss_securityrequirementscr":"ND","cvss_securityrequirementsir":"ND","cvss_securityrequirementsar":"ND","cvss_basescore":"10","cvss_basevector":"AV:N/AC:L/Au:N/C:C/I:C/A:C","cvss_temporalscore":"9","cvss_environmentalscore":"6.746283936","cvss_environmentalvector":"CDP:ND/TD:M/CR:ND/IR:ND/AR:ND","metric":0.0,"vulnote":null}