VAR-201911-0362
Vulnerability from variot - Updated: 2024-11-23 22:58The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product's one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security. MF910S Contains an information disclosure vulnerability.Information may be obtained. ZTE MF910S is a portable 4G wireless router from ZTE Corporation of China. The vulnerability stems from a configuration error in the network system or product during operation. Unauthorized attackers can use vulnerabilities to obtain sensitive information about affected components. SEC Consult Vulnerability Lab Security Advisory < 20200827-0 >
title: Multiple Vulnerabilities
product: ZTE mobile Hotspot MS910S
vulnerable version: DL_MF910S_CN_EUV1.00.01 fixed version: - CVE number: CVE-2019-3422 impact: High homepage: https://www.zte.com.cn found: 2019-09-25 by: Ying Shen T. Founded in 1985 and listed on both the Hong Kong and Shenzhen Stock Exchanges, the company has been committed to providing integrated end-to-end innovations to deliver excellence and value to consumers, carriers, businesses and public sector customers from over 160 countries around the world to enable increased connectivity and productivity."
Source: https://www.zte.com.cn/global/about/corporate_information
Business recommendation:
The vendor recommends to change the hardware and use a newer product.
SEC Consult recommends to remove the device from productive environments.
Vulnerability overview/description:
1) Hard-coded Administrator Password The hard-coded administrator password was found in the ZTE mobile hotspot MS910S firmware version "CN_EUV1.00.01", which is available at. http://devicedownload.zte.com.cn/support/product/201701161506340/soft/20170116151106465.zip
2) Known BusyBox Vulnerabilities The used BusyBox toolkit in version 1.15.0 is outdated and contains multiple known vulnerabilities. The outdated version was found by IoT Inspector. One of the discovered vulnerabilities (CVE-2017-16544) was verified by using the MEDUSA scalable firmware run-time.
3) Known Backdoor in GoAhead Webserver An unusual "telnetd" port was identified on an emulated device which led to the assumption that a backdoor can be opened via the GoAhead web-server. This conclusion was done because of a blog post from another researcher: http://blog.asiantuntijakaveri.fi/2017/03/backdoor-and-root-shell-on-zte-mf286.html
By partially reverse engineering the binaries of the GoAhead webserver, the functionality described in the corresponding blog post can be underpinned.
Proof of concept:
1) Hard-coded Administrator Password The firmware file (ZTE_MF910SV1.0.1B09.bin) is using the JFFS2 filesystem which was extracted. The hardcoded password can be found in the /etc/shadow file within the firmware:
/_DL_MF910S_CN_EUV1.00.01.exe.extracted/Data/version/_ZTE_MF910SV1.0.1B09.bin.extracted/jffs2-root/fs_1/etc/shadow
The file content is shown below:
root:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7::: Admin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7::: bin::10933:0:99999:7::: daemon::10933:0:99999:7::: adm::10933:0:99999:7::: lp::10933:0:99999:7::: sync::10933:0:99999:7::: shutdown::10933:0:99999:7::: halt::10933:0:99999:7::: uucp::10933:0:99999:7::: operator::10933:0:99999:7::: nobody::10933:0:99999:7::: ap71::10933:0:99999:7:::
Both the user "root" and "admin" are using the same weak hardcoded password "5up".
2) Known BusyBox Vulnerabilities BusyBox version 1.12.0 contains multiple CVEs like: CVE-2013-1813, CVE-2016-2148, CVE-2016-6301, CVE-2011-2716, CVE-2011-5325, CVE-2015-9261, CVE-2016-2147 and more.
The BusyBox shell autocompletion vulnerability (CVE-2017-16544) was verified on an emulated device. A file with the name "\ectest\n\e]55;test.txt\a" was crea- ted to trigger the vulnerability.
ls "pressing "
test ]55;test.txt
3) Known Backdoor in GoAhead Webserver Starting the telnet daemon on the emulated device leads to a listener on a very unusual port: [...]
telnetd
netstat -tulen
Active Internet connections (only servers) Proto Recv-Q Send-Q Local Address Foreign Address State tcp 0 0 0.0.0.0:4719 0.0.0.0:* LISTEN [...]
Because this seems to be not configured on the system by any file, the BusyBox binary was inspected.
The pseudocode snippet of BusyBox' telnetd function that was generated by Hex- Rays ARM Decompiler, indicated that this port was hard-coded: dword_788DC = (int)"/bin/login"; dword_788E0 = (int)"/etc/issue.net"; v3 = sub_5DBFC(a2, "f:l:Kip:b:F", &dword_788E0, &dword_788DC, &v76, &v75); v4 = v3 & 8; v5 = v3; if ( !(v3 & 8) && !(v3 & 0x40) ) sub_64A10(v3 & 8); if ( (v5 & 0x48) != 64 ) { openlog((const char *)dword_798DC, 1, 24); dword_78630 = 2; } if ( v5 & 0x10 ) v6 = sub_64FF8(v76); else v6 = 4719; <------------------------------------- Port "4719" if ( !v4 ) { v2 = sub_65578(v75, v6); sub_E394(v2, 1); sub_D9B0(v2); goto LABEL_13; } dword_788D8 = (int)sub_1C480(0); if ( dword_788D8 ) {
This led to the assumption that the GoAhead webserver was modified like described in the following blog post: http://blog.asiantuntijakaveri.fi/2017/03/backdoor-and-root-shell-on-zte-mf286.html
Inspecting the GoAhead webserver binary reinforces this assumption. The pseudocode was generated with Hex-Rays ARM Decompiler, like for the prior BusyBox binary: int __fastcall sub_21D48(int a1) { int v1; // r5 const char *v2; // r4
v1 = a1; cfg_get("debug_level"); v2 = (const char *)sub_17DF0(v1, "change_mode", ""); cfg_set("login_9527", "1"); if ( !strcmp("1", v2) ) { cfg_set("change_mode", "1"); cfg_get("debug_level"); system("mode_change 1"); } else if ( !strcmp("2", v2) ) <--- change mode "2" { cfg_get("debug_level"); system("telnetd &"); <--------- telnet daemon started } else if ( !strcmp("3", v2) ) { cfg_get("debug_level"); system("rem_start.sh &"); } else if ( !strcmp("4", v2) ) { cfg_get("debug_level"); system("rem_kill.sh &"); } else { cfg_set("change_mode", "0"); cfg_get("debug_level"); system("mode_change 0"); } return sub_34374(v1, "success"); }
Other scripts could also be started via the webserver, like "rem_start.sh". This script contains the following lines:
!/bin/sh
if ps|grep remserial then echo "remserial is running.." else remserial -p 10005 -r 192.168.1.10 -s "115200 raw" /dev/ttyUSB0 & fi
That means, that a serial console with the speed of 115200 Baud on port 10005 is started.
Vulnerable / tested versions:
The following firmware has been tested, which was the latest version available during the time of the test: * DL_MF910S_CN_EUV1.00.01
Vendor contact timeline:
2019-09-30: Contacting vendor through psirt@zte.com.cn 2019-10-10: Vendor provides initial contact. 2019-10-14: Vendor confirmed receive of the advisory. 2019-10-15: ZTE confirmed the hard-coded administrator password issue. The GoAhead webserver backdoor is still analyzed. 2019-11-05: ZTE released a Security Bullentin that the product MF910S is end-of-service*. 2020-08-27: Release of security advisory.
- http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011722
Solution:
Upgrade to new hardware.
Workaround:
None. It ensures the continued knowledge gain of SEC Consult in the field of network and application security to stay ahead of the attacker. The SEC Consult Vulnerability Lab supports high-quality penetration testing and the evaluation of new offensive and defensive technologies for our customers.
Interested to work with the experts of SEC Consult?
Send us your application https://www.sec-consult.com/en/career/index.html
Interested in improving your cyber security with the experts of SEC Consult?
Contact our local offices https://www.sec-consult.com/en/contact/index.html
Mail: research at sec-consult dot com Web: https://www.sec-consult.com Blog: http://blog.sec-consult.com Twitter: https://twitter.com/sec_consult
EOF Thomas Weber / @2020
Show details on source website{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-201911-0362",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "mf910s",
"scope": null,
"trust": 1.4,
"vendor": "zte",
"version": null
},
{
"model": "mf910s",
"scope": "eq",
"trust": 1.0,
"vendor": "zte",
"version": null
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"db": "NVD",
"id": "CVE-2019-3422"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/o:zte:mf910s_firmware",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "T. Weber",
"sources": [
{
"db": "PACKETSTORM",
"id": "158990"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-428"
}
],
"trust": 0.7
},
"cve": "CVE-2019-3422",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "MEDIUM",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 1.9,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.4,
"id": "CVE-2019-3422",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 1.8,
"vectorString": "AV:L/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"author": "CNVD",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 3.9,
"id": "CNVD-2020-49292",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "LOW",
"trust": 0.6,
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [
{
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 6.2,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"exploitabilityScore": 2.5,
"id": "CVE-2019-3422",
"impactScore": 3.6,
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"trust": 1.0,
"userInteraction": "NONE",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.1"
},
{
"attackComplexity": "Low",
"attackVector": "Local",
"author": "NVD",
"availabilityImpact": "None",
"baseScore": 6.2,
"baseSeverity": "Medium",
"confidentialityImpact": "High",
"exploitabilityScore": null,
"id": "CVE-2019-3422",
"impactScore": null,
"integrityImpact": "None",
"privilegesRequired": "None",
"scope": "Unchanged",
"trust": 0.8,
"userInteraction": "None",
"vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
"version": "3.0"
}
],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2019-3422",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2019-3422",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNVD",
"id": "CNVD-2020-49292",
"trust": 0.6,
"value": "LOW"
},
{
"author": "CNNVD",
"id": "CNNVD-201911-428",
"trust": 0.6,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-428"
},
{
"db": "NVD",
"id": "CVE-2019-3422"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Sec Consult Security Lab reported an information disclosure vulnerability in MF910S product to ZTE PSIRT in October 2019. Through the analysis of related product team, the information disclosure vulnerability is confirmed. The MF910S product\u0027s one-click upgrade tool can obtain the Telnet remote login password in the reverse way. If Telnet is opened, the attacker can remotely log in to the device through the cracked password, resulting in information leakage. The MF910S was end of service on October 23, 2019, ZTE recommends users to choose new products for the purpose of better security. MF910S Contains an information disclosure vulnerability.Information may be obtained. ZTE MF910S is a portable 4G wireless router from ZTE Corporation of China. The vulnerability stems from a configuration error in the network system or product during operation. Unauthorized attackers can use vulnerabilities to obtain sensitive information about affected components. SEC Consult Vulnerability Lab Security Advisory \u003c 20200827-0 \u003e\n=======================================================================\n title: Multiple Vulnerabilities\n product: ZTE mobile Hotspot MS910S\n vulnerable version: DL_MF910S_CN_EUV1.00.01\n fixed version: -\n CVE number: CVE-2019-3422\n impact: High\n homepage: https://www.zte.com.cn\n found: 2019-09-25\n by: Ying Shen\n T. Founded in 1985 and listed on both the Hong Kong and Shenzhen Stock\nExchanges, the company has been committed to providing integrated end-to-end\ninnovations to deliver excellence and value to consumers, carriers, businesses\nand public sector customers from over 160 countries around the world to enable\nincreased connectivity and productivity.\"\n\nSource: https://www.zte.com.cn/global/about/corporate_information\n\n\nBusiness recommendation:\n------------------------\nThe vendor recommends to change the hardware and use a newer product. \n\nSEC Consult recommends to remove the device from productive environments. \n\n\nVulnerability overview/description:\n-----------------------------------\n1) Hard-coded Administrator Password\nThe hard-coded administrator password was found in the ZTE mobile hotspot\nMS910S firmware version \"CN_EUV1.00.01\", which is available at. \nhttp://devicedownload.zte.com.cn/support/product/201701161506340/soft/20170116151106465.zip\n\n2) Known BusyBox Vulnerabilities\nThe used BusyBox toolkit in version 1.15.0 is outdated and contains multiple\nknown vulnerabilities. The outdated version was found by IoT Inspector. \nOne of the discovered vulnerabilities (CVE-2017-16544) was verified by using\nthe MEDUSA scalable firmware run-time. \n\n3) Known Backdoor in GoAhead Webserver\nAn unusual \"telnetd\" port was identified on an emulated device which led to the\nassumption that a backdoor can be opened via the GoAhead web-server. \nThis conclusion was done because of a blog post from another researcher:\nhttp://blog.asiantuntijakaveri.fi/2017/03/backdoor-and-root-shell-on-zte-mf286.html\n\nBy partially reverse engineering the binaries of the GoAhead webserver, the\nfunctionality described in the corresponding blog post can be underpinned. \n\nProof of concept:\n-----------------\n1) Hard-coded Administrator Password\nThe firmware file (ZTE_MF910SV1.0.1B09.bin) is using the JFFS2 filesystem which\nwas extracted. The hardcoded password can be found in the /etc/shadow file\nwithin the firmware:\n\n/_DL_MF910S_CN_EUV1.00.01.exe.extracted/Data/version/_ZTE_MF910SV1.0.1B09.bin.extracted/jffs2-root/fs_1/etc/shadow\n\nThe file content is shown below:\n-------------------------------------------------------------------------------\nroot:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::\nAdmin:$1$$zdlNHiCDxYDfeF4MZL.H3/:10933:0:99999:7:::\nbin::10933:0:99999:7:::\ndaemon::10933:0:99999:7:::\nadm::10933:0:99999:7:::\nlp:*:10933:0:99999:7:::\nsync:*:10933:0:99999:7:::\nshutdown:*:10933:0:99999:7:::\nhalt:*:10933:0:99999:7:::\nuucp:*:10933:0:99999:7:::\noperator:*:10933:0:99999:7:::\nnobody::10933:0:99999:7:::\nap71::10933:0:99999:7:::\n-------------------------------------------------------------------------------\nBoth the user \"root\" and \"admin\" are using the same weak hardcoded password\n\"5up\". \n\n2) Known BusyBox Vulnerabilities\nBusyBox version 1.12.0 contains multiple CVEs like:\nCVE-2013-1813, CVE-2016-2148, CVE-2016-6301, CVE-2011-2716, CVE-2011-5325,\nCVE-2015-9261, CVE-2016-2147 and more. \n\nThe BusyBox shell autocompletion vulnerability (CVE-2017-16544) was verified on\nan emulated device. A file with the name \"\\ectest\\n\\e]55;test.txt\\a\" was crea-\nted to trigger the vulnerability. \n\n-------------------------------------------------------------------------------\n# ls \"pressing \u003cTAB\u003e\"\ntest\n]55;test.txt\n#\n-------------------------------------------------------------------------------\n\n3) Known Backdoor in GoAhead Webserver\nStarting the telnet daemon on the emulated device leads to a listener on a very\nunusual port:\n[...]\n# telnetd\n#netstat -tulen\nActive Internet connections (only servers)\nProto Recv-Q Send-Q Local Address Foreign Address State\ntcp 0 0 0.0.0.0:4719 0.0.0.0:* LISTEN\n[...]\n\nBecause this seems to be not configured on the system by any file, the BusyBox\nbinary was inspected. \n\nThe pseudocode snippet of BusyBox\u0027 telnetd function that was generated by Hex-\nRays ARM Decompiler, indicated that this port was hard-coded:\n\u003csnip\u003e\ndword_788DC = (int)\"/bin/login\";\n dword_788E0 = (int)\"/etc/issue.net\";\n v3 = sub_5DBFC(a2, \"f:l:Kip:b:F\", \u0026dword_788E0, \u0026dword_788DC, \u0026v76, \u0026v75);\n v4 = v3 \u0026 8;\n v5 = v3;\n if ( !(v3 \u0026 8) \u0026\u0026 !(v3 \u0026 0x40) )\n sub_64A10(v3 \u0026 8);\n if ( (v5 \u0026 0x48) != 64 )\n {\n openlog((const char *)dword_798DC, 1, 24);\n dword_78630 = 2;\n }\n if ( v5 \u0026 0x10 )\n v6 = sub_64FF8(v76);\n else\n v6 = 4719; \u003c------------------------------------- Port \"4719\"\n if ( !v4 )\n {\n v2 = sub_65578(v75, v6);\n sub_E394(v2, 1);\n sub_D9B0(v2);\n goto LABEL_13;\n }\n dword_788D8 = (int)sub_1C480(0);\n if ( dword_788D8 )\n {\n\u003csnip\u003e\n\nThis led to the assumption that the GoAhead webserver was modified like\ndescribed in the following blog post:\nhttp://blog.asiantuntijakaveri.fi/2017/03/backdoor-and-root-shell-on-zte-mf286.html\n\nInspecting the GoAhead webserver binary reinforces this assumption. The\npseudocode was generated with Hex-Rays ARM Decompiler, like for the prior\nBusyBox binary:\n\u003csnip\u003e\nint __fastcall sub_21D48(int a1)\n{\n int v1; // r5\n const char *v2; // r4\n\n v1 = a1;\n cfg_get(\"debug_level\");\n v2 = (const char *)sub_17DF0(v1, \"change_mode\", \"\");\n cfg_set(\"login_9527\", \"1\");\n if ( !strcmp(\"1\", v2) )\n {\n cfg_set(\"change_mode\", \"1\");\n cfg_get(\"debug_level\");\n system(\"mode_change 1\");\n }\n else if ( !strcmp(\"2\", v2) ) \u003c--- change mode \"2\"\n {\n cfg_get(\"debug_level\");\n system(\"telnetd \u0026\"); \u003c--------- telnet daemon started\n }\n else if ( !strcmp(\"3\", v2) )\n {\n cfg_get(\"debug_level\");\n system(\"rem_start.sh \u0026\");\n }\n else if ( !strcmp(\"4\", v2) )\n {\n cfg_get(\"debug_level\");\n system(\"rem_kill.sh \u0026\");\n }\n else\n {\n cfg_set(\"change_mode\", \"0\");\n cfg_get(\"debug_level\");\n system(\"mode_change 0\");\n }\n return sub_34374(v1, \"success\");\n}\n\u003csnip\u003e\n\nOther scripts could also be started via the webserver, like \"rem_start.sh\". \nThis script contains the following lines:\n\n#!/bin/sh\nif ps|grep remserial\nthen\necho \"remserial is running..\"\nelse\nremserial -p 10005 -r 192.168.1.10 -s \"115200 raw\" /dev/ttyUSB0 \u0026\nfi\n\nThat means, that a serial console with the speed of 115200 Baud on port 10005\nis started. \n\nVulnerable / tested versions:\n-----------------------------\nThe following firmware has been tested, which was the latest version available\nduring the time of the test:\n* DL_MF910S_CN_EUV1.00.01\n\n\nVendor contact timeline:\n------------------------\n2019-09-30: Contacting vendor through psirt@zte.com.cn\n2019-10-10: Vendor provides initial contact. \n2019-10-14: Vendor confirmed receive of the advisory. \n2019-10-15: ZTE confirmed the hard-coded administrator password issue. The\n GoAhead webserver backdoor is still analyzed. \n2019-11-05: ZTE released a Security Bullentin that the product MF910S is\n end-of-service*. \n2020-08-27: Release of security advisory. \n\n* http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011722\n\n\nSolution:\n---------\nUpgrade to new hardware. \n\n\nWorkaround:\n-----------\nNone. It\nensures the continued knowledge gain of SEC Consult in the field of network\nand application security to stay ahead of the attacker. The SEC Consult\nVulnerability Lab supports high-quality penetration testing and the evaluation\nof new offensive and defensive technologies for our customers. \n\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\nInterested to work with the experts of SEC Consult?\nSend us your application https://www.sec-consult.com/en/career/index.html\n\nInterested in improving your cyber security with the experts of SEC Consult?\nContact our local offices https://www.sec-consult.com/en/contact/index.html\n~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~\n\nMail: research at sec-consult dot com\nWeb: https://www.sec-consult.com\nBlog: http://blog.sec-consult.com\nTwitter: https://twitter.com/sec_consult\n\nEOF Thomas Weber / @2020\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2019-3422"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"db": "PACKETSTORM",
"id": "158990"
}
],
"trust": 2.25
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2019-3422",
"trust": 3.1
},
{
"db": "ZTE",
"id": "1011722",
"trust": 2.3
},
{
"db": "PACKETSTORM",
"id": "158990",
"trust": 1.7
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011858",
"trust": 0.8
},
{
"db": "CNVD",
"id": "CNVD-2020-49292",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-201911-428",
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"db": "PACKETSTORM",
"id": "158990"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-428"
},
{
"db": "NVD",
"id": "CVE-2019-3422"
}
]
},
"id": "VAR-201911-0362",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-49292"
}
],
"trust": 1.2666667
},
"iot_taxonomy": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot_taxonomy#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"category": [
"Network device"
],
"sub_category": null,
"trust": 0.6
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-49292"
}
]
},
"last_update_date": "2024-11-23T22:58:29.252000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Statement of Vulnerability in ZTE MF910S Product",
"trust": 0.8,
"url": "http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1011722"
},
{
"title": "Patch for Information Disclosure Vulnerability in ZTE MF910S",
"trust": 0.6,
"url": "https://www.cnvd.org.cn/patchInfo/show/248866"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "CWE-200",
"trust": 1.8
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"db": "NVD",
"id": "CVE-2019-3422"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 2.3,
"url": "http://support.zte.com.cn/support/news/loopholeinfodetail.aspx?newsid=1011722"
},
{
"trust": 1.6,
"url": "http://seclists.org/fulldisclosure/2020/aug/20"
},
{
"trust": 1.6,
"url": "http://packetstormsecurity.com/files/158990/zte-mobile-hotspot-ms910s-backdoor-hardcoded-password.html"
},
{
"trust": 1.5,
"url": "https://nvd.nist.gov/vuln/detail/cve-2019-3422"
},
{
"trust": 0.8,
"url": "https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2019-3422"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com/en/vulnerability-lab/advisories/index.html"
},
{
"trust": 0.1,
"url": "http://blog.asiantuntijakaveri.fi/2017/03/backdoor-and-root-shell-on-zte-mf286.html"
},
{
"trust": 0.1,
"url": "https://www.zte.com.cn"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com"
},
{
"trust": 0.1,
"url": "https://twitter.com/sec_consult"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com/en/contact/index.html"
},
{
"trust": 0.1,
"url": "http://blog.sec-consult.com"
},
{
"trust": 0.1,
"url": "https://www.zte.com.cn/global/about/corporate_information"
},
{
"trust": 0.1,
"url": "http://devicedownload.zte.com.cn/support/product/201701161506340/soft/20170116151106465.zip"
},
{
"trust": 0.1,
"url": "https://www.sec-consult.com/en/career/index.html"
}
],
"sources": [
{
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"db": "PACKETSTORM",
"id": "158990"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-428"
},
{
"db": "NVD",
"id": "CVE-2019-3422"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"db": "PACKETSTORM",
"id": "158990"
},
{
"db": "CNNVD",
"id": "CNNVD-201911-428"
},
{
"db": "NVD",
"id": "CVE-2019-3422"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2020-08-29T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"date": "2019-11-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"date": "2020-08-27T22:56:43",
"db": "PACKETSTORM",
"id": "158990"
},
{
"date": "2019-11-07T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201911-428"
},
{
"date": "2019-11-07T20:15:11.013000",
"db": "NVD",
"id": "CVE-2019-3422"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2021-02-23T00:00:00",
"db": "CNVD",
"id": "CNVD-2020-49292"
},
{
"date": "2019-11-19T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2019-011858"
},
{
"date": "2020-08-31T00:00:00",
"db": "CNNVD",
"id": "CNNVD-201911-428"
},
{
"date": "2024-11-21T04:42:04.093000",
"db": "NVD",
"id": "CVE-2019-3422"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "local",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201911-428"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "MF910S Vulnerable to information disclosure",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2019-011858"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "information disclosure",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-201911-428"
}
],
"trust": 0.6
}
}
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.