Summaryinfo

A vulnerability identified as problematic has been detected in Pirelli Router P.DGA4001N. This vulnerability affects unknown code of the file rebootinfo.cgi. Performing a manipulation results in access control. This vulnerability is identified as CVE-2015-0554. The attack can be initiated remotely. Additionally, an exploit exists. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Pirelli Router P.DGA4001N (Router Operating System). This affects some unknown functionality of the file rebootinfo.cgi. The manipulation with an unknown input leads to a access control vulnerability. CWE is classifying the issue as CWE-264. This is going to have an impact on availability.

The weakness was released 01/05/2015 by Eduardo Pablo Novella Lorente (@enovella_) with Universitat Politècnica de València as CVE-2015-0554_pirelli.txt as not defined advisory (Website). It is possible to read the advisory at ednolo.alumnos.upv.es. This vulnerability is uniquely identified as CVE-2015-0554 since 01/05/2015. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1068 according to MITRE ATT&CK.

A public exploit has been developed by Eduardo Pablo Novella Lorente in Javascript and been published immediately after the advisory. The exploit is shared for download at ednolo.alumnos.upv.es. It is declared as highly functional. The code used by the exploit is:

var sessionKey='846930886';
function btnReset() {
   var loc = 'rebootinfo.cgi?';

   loc += 'sessionKey=' + sessionKey;

   var code = 'location="' + loc + '"';
   eval(code);
}

It is possible to mitigate the weakness by firewalling . The advisory contains the following remark:

First mitigation could be either try to update the last version for these routers or install 3rd parties firmwares as OpenWRT or DDWRT on them.

The vulnerability is also documented in the vulnerability database at Exploit-DB (35721). Further details are available at packetstormsecurity.com. Entry connected to this vulnerability is available at VDB-68510. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Pirelli

Name

• Router

Version

• P.DGA4001N

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion