[Full-Disclosure] Thomson TCW690 POST Password Validation Vulnerability
murdok.lnx at gmail.com
Sat Feb 19 09:41:45 GMT 2005
I found a vulnerability in this cablemodem which a malicious user inside *LAN
can get the control of the cablemodem easily.
This cablemodem model is given by the spanish ISP "AUNA".
Product: Thomson TCW690 cablemodem
Affected Version: ST42.03.0a (not tested in minor versions)
Immune Version: ???
Vendor-Status: informed but no response
The http server inside this cablemodem doesn't properly validate the supplied
password when an user want to do some change in the configuration and sends a
POST request. In the exploit I show how to change the admin password but you
can also open ports, deny a user access, restore factory defaults, (all)...
with a little changes.
No response from vendor. There isn't fix available.
2005.02.06 - Bug found.
2005.02.07 - Informed the vendor broadband at thomson.net, no response.
2005.02.11 - Informed the vendor webmaster at thomson.net no response too.
2005.02.19 - Public disclosure.
-------------- next part --------------
A non-text attachment was scrubbed...
Size: 2648 bytes
Desc: not available
Url : http://lists.grok.org.uk/pipermail/full-disclosure/attachments/20050219/08c8f0ff/attachment.bin
Full-Disclosure is hosted and sponsored by Secunia.