Multiple vulnerabilities in WiFi router COMTREND CT-536/HG-536+

Antecedentes

The CT-536 is an 802.11g (54 Mbps) wireless and wired ADSL router with four 10/100 Ethernet ports, one USB port, and a built-in WiFi access point. It offers security features such as WPA encryption, a firewall, and VPN pass-through.

Description

Incorrect validation by the micro_httpd server allows for several attacks via this stateless server. Access control is inadequate, and credentials are transmitted in plaintext, allowing the "user" to easily obtain them. Some fields are not filtered, so XSS attacks and buffer overflows can cause the configuration server to crash. In some cases, the router must be restarted and loses its configuration, reverting to default settings: default passwords, an open wireless network, etc.

Business impact

Denial of service of the web configuration interface even though the router continues routing; denial of service of the router with configuration reset, which leaves the wireless interface active without any protection and allows access to the router or the network; and access with administrator ("admin") permissions from the "user" account.

Affected systems

Firmware up to version A101-302JAZ-C01_R05 (the current version at the time of publication).

Solución

Replace the router.

Calendario de divulgación

References

The information contained within this advisory is supplied 'as-is' with no warranties or guarantees of fitness for use or otherwise. Internet Security Auditors accepts no responsibility for any damage caused by the use or misuse of this information.