Multiple vulnerabilities in DASAN H660RM GPON router firmware

CVE-2019-9974: diag_tool.cgi on DASAN H660RM devices with firmware 1.03-0022 allows spawning ping processes without any authorization leading to information disclosure and DoS attacks

Remote attacker could enumerate hosts on LAN interface sending requests to /cgi-bin/diag_tool.cgi with ip parameter set to target IP address. Lack of authorization in /cgi-bin/diag_get_result.cgi allow retrieval of results. Each call to diag_get_result.cgi retrieves one line of ping (or traceroute) output.

Same CGI script has another weakness, CWE-400: Uncontrolled Resource Consumption, which allows memory memory exhaustion Denial of Service (DoS) attack against device. Around 170 spawned ping processes is enough to cause crash and reboot of router. PoC exploit available.

More: https://blog.burghardt.pl/2019/03/diag_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-allows-spawning-ping-processes-without-any-authorization-leading-to-information-disclosure-and-dos-attacks/

----------
CVE-2019-9975: syslog_tool.cgi on DASAN H660RM devices with firmware 1.03-0022 uses a hard-coded key for logs encryption

DASAN uses a hard-coded key “dasanektks123” for logs encryption. Data stored using this key can be decrypted by anyone able to access this key.

More: https://blog.burghardt.pl/2019/03/syslog_tool-cgi-on-dasan-h660rm-devices-with-firmware-1-03-0022-uses-a-hard-coded-key-for-logs-encryption/

----------
CVE-2019-9976: Boa Webserver on DASAN H660RM devices with firmware 1.03-0022 saves post data, including credentials, to /tmp/boa-temp

Exploitation is possible for users logged in over telnet of SSH. If user logged though Web UI and until he make any other POST request, his credentials can be retrieved with:

$ cat /tmp/boa-temp

StatusActionFlag=-1&Username=admin&Password=vertex25

More: https://blog.burghardt.pl/2019/03/boa-webserver-on-dasan-h660rm-devices-with-firmware-1-03-0022-saves-post-data-including-credentials-to-tmp-boa-temp/