NEC Aterm WG2600HP2 1.0.2 Web Service API negotiate HTTP Request access control

Summaryinfo

A vulnerability was found in NEC Aterm WG2600HP2 1.0.2. It has been rated as critical. The impacted element is an unknown function of the file /aterm_httpif.cgi/negotiate of the component Web Service API. Performing a manipulation as part of HTTP Request results in access control. This vulnerability is reported as CVE-2017-12575. The attack is possible to be carried out remotely. Moreover, an exploit is present. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability was found in NEC Aterm WG2600HP2 1.0.2. It has been classified as critical. This affects an unknown function of the file /aterm_httpif.cgi/negotiate of the component Web Service API. The manipulation as part of a HTTP Request leads to a access control vulnerability. CWE is classifying the issue as CWE-284. The product does not restrict or incorrectly restricts access to a resource from an unauthorized actor. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

An issue was discovered on the NEC Aterm WG2600HP2 1.0.2. The router has a set of web service APIs for access to and setup of the configuration. Some APIs don't require authentication. An attacker could exploit this vulnerability by sending a crafted HTTP request to retrieve DHCP clients, firmware version, and network status (ex.: curl -X http://[IP]/aterm_httpif.cgi/negotiate -d "REQ_ID=SUPPORT_IF_GET").

The bug was discovered 08/21/2018. The weakness was disclosed 08/24/2018 as not defined mailinglist post (Full-Disclosure). It is possible to read the advisory at seclists.org. This vulnerability is uniquely identified as CVE-2017-12575 since 08/05/2017. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

After immediately, there has been an exploit disclosed. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 3 days. During that time the estimated underground price was around $0-$5k.

It is possible to mitigate the weakness by firewalling .

Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Vendor

• NEC Aterm

Name

• WG2600HP2

Version

• 1.0.2

License

• commercial

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion