HackMD
DLINK DPH-400SE - Exposure of Sensitive Information to an Unauthorized Actor
-- RICKROLL --
Description
During a local CTF, there was a challenge that had a VoIP. I interacted with DLINK DPH-400SE running a firmware version of FRU 2.2.15.8. It's basically a VoIP phone and the vendor is DLINK In this writeup. I explain how I was able to uncover yet another vulnerability generally a weakness of the ID 200 : CWE-200, This weakness allowed me to login to the web portal of the device using default guest credentials and read all the SIP authenticated user passwords as well as the administrator's password.
POC
Log in to the portal using the credentials "guest:guest"
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
Heading to the maintenance tab, we have the access feature which has an option to modify accounts accessing the devices:
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
Opening the modify settings, the guest user is able to modify the user, as well as read the password of that user since it's displayed in the input field thus, by right clicking it and clicking "reveal password" it should display the password for the user chosen to be modified by the "Guest" user.
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
- The image was uploaded to a note which you don't have access to
- The note which the image was originally uploaded to has been deleted
Copy the password logout the portal and use the password to login as the user Admin, and WE ARE IN!
