PT-2017-13280 · Fiberhome · Fiberhome User End Routers

Ibad Shah · Published 2017-09-07 · Updated 2021-07-02 · CVE-2017-14147

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions FiberHome User End Routers version AN1020-25

Description An issue was discovered that could allow an attacker to easily restore a router to its factory settings by browsing to the "http://[Default-Router-IP]/restoreinfo.cgi" API endpoint and executing it. Due to improper authentication on this page, the software accepts the request, allowing the attacker to reset the router to its default configurations, which could later allow the attacker to login to the router using the default username and password.

Recommendations For FiberHome User End Routers version AN1020-25, as a temporary workaround, consider restricting access to the "/restoreinfo.cgi" API endpoint to minimize the risk of exploitation. Avoid using the default username and password until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Improper Authentication

Weakness Enumeration

CWE-287

Related Identifiers

CVE-2017-14147

Affected Products

Fiberhome User End Routers

References · 4

• 🔥 https://exploit-db.com/exploits/42649 · Exploit
• 🔥 http://packetstormsecurity.com/files/144022/FiberHome-Unauthenticated-ADSL-Router-Factory-Reset.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2017-14147 · Security Note
• https://beefaaubee09.github.io/fiberhome-adsls-dos · Note