← Advisories

NEC Univerge SV9100/SV8100 WebPro 10.0 Remote Configuration Download

High
Advisory ID
ZSL-2018-5448
Release Date
22 January 2018
Vendor
NEC Corporation - http://www.nec.com
Affected Version
WebPro <=10.00, DSP Firmware Version: 12.11.00.02
CVE
N/A
Tested On
Henry/1.1, NEC-i SV8100-NA 08.00/2.1, NEC SV9100-GE 07.00.52/2.1
Summary

NEC's UNIVERGE® SV9100 is the unified communications (UC) solution of choice for small and medium businesses (SMBs) who don't want to be left behind. Designed to fit your unique needs, the UNIVERGE SV9100 platform is a powerful communications solution that provides SMBs with the efficient, easy-to-deploy, mobile technology that they require.

Description

The gzipped telephone system configuration file 'config.gz' or 'config.pcpx' that contains the unencrypted data file 'conf.pcpn', can be downloaded by an attacker from the root directory if previously generated by a privileged user. Attacker can also sniff the network and hijack the session id which resides in a GET request to further generate the config file. The sessionid can also be brute-forced because of its predictability containing 5-digit number. This will enable the attacker to disclose sensitive information and help her in authentication bypass, privilege escalation, system access and denial of service via config modification.

Proof of Concept
Disclosure Timeline
11.12.2017Vulnerability discovered.
27.12.2017Vendor contacted.
21.01.2018No response from the vendor.
22.01.2018Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
22.01.2018Initial release
27.01.2018Added reference [1], [2], [3] and [4]