Huawei EchoLife HG520 Remote Information Disclosure

Summary

Huawei EchoLife HG520 modems are vulnerable to a remote information disclosure vulnerability. This vulnerability can be exploited by sending a specially crafted UDP packet that causes the modems to return sensitive information in clear text form.

Description

# Exploit Title: Huawei EchoLife HG520 Remote Information Disclosure
# Date: 2010-04-19
# Product Link: http://www.huawei.com/mobileweb/en/products/view.do?id=660
# Firmware Versions: 3.10.18.7-1.0.7.0
# 3.10.18.5-1.0.7.0
# 3.10.18.4
# Software Versions: V100R001B120Telmex
# V100R001B121Telmex
# Exploit Download Link:
# http://www.hakim.ws/huawei/HG520_udpinfo.tar.gz
# http://www.exploit-db.com/sploits/HG520_udpinfo.tar.gz
Websec Advisory: ws10-10


By sending a specially crafted UDP packet you can remotely obtain the
following information: software and firmware versions, MAC, local and
remote IP, model and PPPoE credentials in clear text.

The files required to reproduce this vulnerability can be downloaded
from:

http://www.hakim.ws/huawei/HG520_udpinfo.tar.gz

Requires Python, Scapy and Tcpdump. The way you run this program to test
a local modem is:

~# python udp520.py

For a remote modem:

~# python udp520.py


* If you can't see the response packet, try using Wireshark.
* If "No module named all" error shows up, install scapy from source.




[email protected]


http://www.websec.mx

POC