PT-2008-4814 · Axesstel · Axesstel Axw-D800

Published 2008-07-31 · Updated 2018-10-11 · CVE-2008-3411

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Axesstel AXW-D800 modem with D2 ETH 109 01 VEBR Jun-14-2006 software

Description The issue concerns a lack of authentication requirement for certain web-based configuration interfaces. Specifically, remote attackers can access and modify the modem's configuration through direct requests to the following API endpoints: "etc/config/System.html", "etc/config/Network.html", "etc/config/Security.html", "cgi-bin/sysconf.cgi", and "cgi-bin/route.cgi". This allows unauthorized changes to the modem's settings.

Recommendations For the Axesstel AXW-D800 modem with D2 ETH 109 01 VEBR Jun-14-2006 software, consider restricting access to the vulnerable API endpoints until a patch is available. As a temporary workaround, limit access to the modem's configuration interfaces to prevent unauthorized changes. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2008-3411

Affected Products

Axesstel Axw-D800

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2008-3411 · Security Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44044 · Note
• http://secunia.com/advisories/31285 · Note
• http://securityfocus.com/bid/30404 · Note
• http://securityfocus.com/archive/1/494815/100/0/threaded · Note
• http://securityreason.com/securityalert/4089 · Note