Zero Science Lab » KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Unauthenticated Config Download

KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Unauthenticated Config Download

Title: KZTech/JatonTec/Neotel JT3500V 4G LTE CPE 2.0.1 Unauthenticated Config Download
Advisory ID: ZSL-2021-5644
Type: Local/Remote
Impact: Security Bypass, Exposure of System Information, Exposure of Sensitive Information, System Access, DoS, Privilege Escalation
Risk: (5/5)
Release Date: 18.03.2021

Summary

JT3500V is a most advanced LTE-A Pro CAT12 indoor Wi-Fi & VoIP CPE product specially designed to enable quick and easy LTE fixed data service deployment for residential and SOHO customers. It provides high speed LAN, Wi-Fi and VoIP integrated services to end users who need both bandwidth and multi-media data service in residential homes or enterprises. The device has 2 Gigabit LAN ports, 1 RJ11 analog phone port, high performance 4x4 MIMO and CA capabilities, 802.11b/g/n/ac dual band Wi-Fi, advanced routing and firewall software for security. It provides an effective all-in-one solution to SOHO or residential customers. It can deliver up to 1Gbps max data throughput which can be very competitive to wired broadband access service.

Description

JT3500V is vulnerable to unauthenticated configuration disclosure when direct object reference is made to the export_settings.cgi file using an HTTP GET request. This will enable the attacker to disclose sensitive information and help her in authentication bypass, privilege escalation and full system access.

Vendor

KZ Broadband Technologies, Ltd. - http://www.kzbtech.com
Jaton Technology, Ltd. - http://www.jatontec.com
Neotel DOO - https://www.neotel.mk

Affected Version

Tested On

GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN
Linux 2.6.36+ (mips)
Mediatek APSoC SDK v4.3.1.0

Vendor Status

[03.02.2021] Vulnerability discovered.
[05.02.2021] Contact with Neotel.
[07.02.2021] Contact with KZ Tech.
[08.02.2021] Contact with Jaton Tech.
[09.02.2021] Contact with Neotel.
[12.02.2021] Contact with MKD-CIRT.
[12.02.2021] MKD-CIRT opens a case, informs Neotel.
[17.03.2021] No response from the vendors.
[18.03.2021] Public security advisory released.

PoC

jt3500v_config.txt

Credits

Vulnerability discovered by Gjoko Krstic - <gjoko@zeroscience.mk>

References

[1] https://www.exploit-db.com/exploits/49686
[2] https://exchange.xforce.ibmcloud.com/vulnerabilities/198536
[3] https://packetstormsecurity.com/files/161890/
[4] https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-28258
[5] https://nvd.nist.gov/vuln/detail/CVE-2021-28258

Changelog

[18.03.2021] - Initial release
[23.03.2021] - Added reference [1], [2] and [3]
[19.06.2021] - Added reference [4] and [5]

Contact

Zero Science Lab

Web: https://www.zeroscience.mk
e-mail: lab@zeroscience.mk