PT-2015-4714 · P.Dga · P.Dga4001N Router

Eduardo Novella + 1 · Published 2015-01-21 · Updated 2015-01-23 · CVE-2015-0554

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:C

Name of the Vulnerable Software and Affected Versions P.DGA4001N router version PDG TEF SP 4.06L.6

Description The issue allows remote attackers to obtain sensitive information or cause a denial of service, such as a device restart, by accessing the web interface. This can be achieved by making a direct request to API endpoints like "wlsecurity.html" or "resetrouter.html".

Recommendations For version PDG TEF SP 4.06L.6, consider restricting access to the web interface as a temporary workaround until a patch is available. Avoid using the API endpoints "wlsecurity.html" and "resetrouter.html" to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Weakness Enumeration

CWE-264

Related Identifiers

CVE-2015-0554

Affected Products

P.Dga4001N Router

References · 4

• 🔥 http://packetstormsecurity.com/files/129828/Pirelli-ADSL2-2-Wireless-Router-P.DGA4001N-Information-Disclosure.html · Exploit
• 🔥 http://exploit-db.com/exploits/35721 · Exploit
• 🔥 https://exploit-db.com/exploits/35721 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2015-0554 · Security Note