[Full-Disclosure] Thomson TCW690 Denial Of Service Vulnerability
murdok.lnx at gmail.com
Sat Feb 19 09:43:44 GMT 2005
I found a vulnerability in this cablemodem which a malicious user inside *LAN
can reset it easily.
This cablemodem model is given by the spanish ISP "AUNA".
Product: Thomson TCW690 cablemodem
Affected Version: ST42.03.0a (possible others)
Immune Version: ???
Vendor-Status: informed but no response
The http server inside this cablemodem doesn't check the length of GET
requests. If you exploit this bug the router will become unstable for ~50
No code needed. Just open your browser to
http://192.168.0.1/AAAA[about 2000 A's]AAA
No response from vendor. There isn't fix available.
2005.02.07 - Bug found.
2005.02.07 - Informed the vendor broadband at thomson.net, no response.
2005.02.11 - Informed the vendor webmaster at thomson.net.
2005.02.19 - Public disclosure.
Full-Disclosure is hosted and sponsored by Secunia.