Pierre Kim

An unauthenticated local file inclusion issue exists, allowing remote attackers to read arbitrary files. By manipulating the `path` parameter in the 'installed emanual down.html' endpoint, attackers can use directory traversal sequences to access files outside the intended manual directory, such as /etc/passwd, system configuration files, and coredump files containing credentials. Exploitation evidence was first observed by the Shadowserver Foundation on 2024-07-30.

The issue concerns the web interface of affected devices, which is designed to hide LDAP credentials from administrative users. However, when LDAP authentication is configured to "SIMPLE", the device communicates with the LDAP server in clear-text, allowing the LDAP password to be retrieved from this communication.

The issue is related to improper processing of some parameters of `installed emanual list.html`, which leads to a path traversal vulnerability. No information is provided about the estimated number of potentially affected devices worldwide or real-world incidents where this issue was exploited.

There are several hidden accounts, some of which are intended for maintenance engineers. With knowledge of their passwords, these accounts can be used to re-configure the device. The passwords can be obtained by examining the coredump.

The issue allows admin authentication to be bypassed using specific invalid credentials, granting administrative privileges. The telnet feature, which is implemented on older models, is planned to be removed via a firmware update.

The issue is related to a NULL pointer dereference in the telnetd application, which can occur via specific byte sequences, such as 0xff 0xf7 or 0xff 0xf8. In a typical installation, the telnetd application would crash, but the telnet service would remain available through inetd. However, if the telnetd application experiences many crashes within a short time interval, the telnet service would become unavailable after inetd logs a "telnet/tcp server failing (looping), service terminated" error.

The issue is a remote code execution vulnerability. A malicious attacker with access to the immediate subnet may potentially exploit this vulnerability, leading to information disclosure and a possible elevation of privileges.

The issue is related to a lack of input data sanitization in the Yealink Device Management platform, allowing a remote attacker to execute arbitrary commands as the root user. Specifically, the "/sm/api/v1/firewall/zone/services" API endpoint is vulnerable to command injection without requiring authentication.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered in the web daemon of FiberHome HG6245D devices, where hardcoded credentials for an ISP are present. The credentials are `f~i!b@e#r$h%o^m*esuperadmin / s(f)u h+g|u`. Recommendations: For FiberHome HG6245D versions through RP2613, consider changing the hardcoded credentials to secure ones as a temporary workaround, until a patch is available. Restrict access to the web daemon to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D devices through RP2613 Description: An issue was discovered where credentials in /fhconf/umconfig.txt are obfuscated via XOR with a hardcoded key. The `webs` binary contains details on how XOR is used for obfuscation. Recommendations: For FiberHome HG6245D devices through RP2613, consider restricting access to the `/fhconf/umconfig.txt` file to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered where the web daemon contains hardcoded admin and lnadmin credentials for an ISP. Recommendations: For FiberHome HG6245D versions through RP2613, consider changing the default admin and lnadmin credentials to custom, secure credentials as a temporary workaround. Restrict access to the web daemon to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered where passwords and authentication cookies are stored in cleartext in the `web.log` HTTP logs. This allows for the potential retrieval of sensitive information. Recommendations: For FiberHome HG6245D versions through RP2613, consider restricting access to the `web.log` file to minimize the risk of exploitation. As a temporary workaround, disable the storage of sensitive information in the HTTP logs until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D devices through RP2613 Description: An issue was discovered where the web management of the devices is done over HTTPS, using a hardcoded private key that has 0777 permissions. Recommendations: For FiberHome HG6245D devices through RP2613, consider restricting access to the web management interface until a fix is available. As a temporary workaround, restrict the permissions of the hardcoded private key to minimize the risk of exploitation.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered where the web daemon contains hardcoded `user` / `user1234` credentials for an ISP. Recommendations: For FiberHome HG6245D versions through RP2613, consider changing the hardcoded credentials as a temporary workaround, and apply a patch if available to remove the hardcoded `user` / `user1234` credentials.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered where the web daemon on the affected devices contains credentials for an ISP that are equal to the last part of the MAC address of the br0 interface. Recommendations: For FiberHome HG6245D versions through RP2613, consider changing the default credentials to prevent unauthorized access, and restrict access to the web daemon until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered where the web daemon contains hardcoded `trueadmin` / `admintrue` credentials for an ISP. This affects FiberHome HG6245D devices. Recommendations: For FiberHome HG6245D versions through RP2613, consider changing the hardcoded `trueadmin` / `admintrue` credentials to secure ones to prevent unauthorized access. As a temporary workaround, restrict access to the web daemon until a patch is available.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered in the web daemon of the affected devices, where hardcoded admin credentials are present, specifically the username 'admin' and password 'G0R2U1P2ag', which are used by an ISP. Recommendations: For FiberHome HG6245D versions through RP2613, consider changing the hardcoded admin credentials to secure ones as a temporary workaround, and await further guidance from the manufacturer for a permanent fix.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered in the web daemon of the affected devices, where hardcoded credentials `gestiontelebucaramanga / t3l3buc4r4m4ng42013` are used for an ISP. Recommendations: For FiberHome HG6245D versions through RP2613, consider changing the hardcoded credentials to secure ones to prevent unauthorized access. As a temporary workaround, restrict access to the web daemon until a patch is available.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D versions through RP2613 Description: An issue was discovered where the web daemon contains hardcoded admin and CUadmin credentials for an ISP. Recommendations: For FiberHome HG6245D versions through RP2613, consider changing the default admin and CUadmin credentials to custom, secure credentials as a temporary workaround. Restrict access to the web daemon to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Name of the Vulnerable Software and Affected Versions: FiberHome HG6245D devices through RP2613 Description: An issue was discovered where the web daemon contains hardcoded `adminpldt` / `z6dUABtl270qRxt7a2uGTiw` credentials for an ISP. Recommendations: For FiberHome HG6245D devices through RP2613, consider changing the hardcoded admin credentials to unique and secure ones to prevent unauthorized access. As a temporary workaround, restrict access to the web daemon until a more permanent solution is available.