ZyXEL Billion 5200W-T adv_remotelog.asp syslogServerAddr command injection

Summaryinfo

A vulnerability identified as critical has been detected in ZyXEL Billion 5200W-T. Impacted is an unknown function of the file adv_remotelog.asp. Performing a manipulation of the argument syslogServerAddr with the input 1.1.1.1%3bping+-c+3+192.168.1.35%3b results in command injection. The attack may be initiated remotely. In addition, an exploit is available. It is suggested to use restrictive firewalling.

Detailsinfo

A vulnerability was found in ZyXEL Billion 5200W-T (affected version not known). It has been classified as critical. This affects some unknown functionality of the file adv_remotelog.asp. The manipulation of the argument syslogServerAddr with the input value 1.1.1.1%3bping+-c+3+192.168.1.35%3b leads to a command injection vulnerability. CWE is classifying the issue as CWE-77. The product constructs all or part of a command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability.

The weakness was presented 12/26/2016 as 2910 as not defined advisory (Website) via Securiteam. It is possible to read the advisory at blogs.securiteam.com. The vendor was not involved in the public release. The exploitability is told to be easy. It is possible to initiate the attack remotely. No form of authentication is needed for exploitation. Technical details and a public exploit are known. The attack technique deployed by this issue is T1202 according to MITRE ATT&CK.

A public exploit has been developed in HTTP POST Request and been published immediately after the advisory. The exploit is shared for download at blogs.securiteam.com. It is declared as proof-of-concept. By approaching the search of inurl:adv_remotelog.asp it is possible to find vulnerable targets with Google Hacking.

It is possible to mitigate the weakness by firewalling . The advisory contains the following remark:

We notified ZyXEL of the vulnerabilities back in July 2016, repeated attempts to re-establish contact and get some answer on the status of the patches for these vulnerabilities went unanswered.

See VDB-94801, VDB-94802, VDB-94804 and VDB-94805 for similar entries. Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Productinfo

Vendor

• ZyXEL

Name

• Billion 5200W-T

License

• commercial

Website

• Vendor: https://www.zyxel.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.

Discussion