← Advisories

Verizon 4G LTE Network Extender Weak Credentials Algorithm

Medium
Advisory ID
ZSL-2022-5701
Release Date
13 April 2022
Vendor
Verizon Communications Inc. - https://www.verizon.com
Affected Version
GA4.38 - V0.4.038.2131
Tested On
lighttpd-web
Summary

An LTE Network Extender enhances your indoor and 4G LTE data and voice coverage to provide better service for your 4G LTE mobile devices. It's an extension of our 4G LTE network that's placed directly in your home or office. The LTE Network Extender works with all Verizon-sold 4G LTE mobile devices for 4G LTE data service and HD Voice-capable 4G LTE devices for voice service. This easy-to-install device operates like a miniature cell tower that plugs into your existing high-speed broadband connection to communicate with the Verizon wireless network.

Description

Verizon's 4G LTE Network Extender is utilising a weak default admin password generation algorithm. The password is generated using the last 4 values from device's MAC address which is disclosed on the main webUI login page to an unauthenticated attacker. The values are then concatenated with the string 'LTEFemto' resulting in something like 'LTEFemtoD080' as the default Admin password.

Proof of Concept
Disclosure Timeline
17.02.2022Vulnerability discovered.
23.02.2022Vendor contacted.
24.02.2022Vendor responds asking more details.
24.02.2022Sent details to the vendor.
06.03.2022Asked vendor for status update.
07.03.2022Vendor has sent the report over to product security team. As soon as they have time to assess, vendor will give us an update.
12.04.2022No response from the vendor.
13.04.2022Public security advisory released.
Credits
Vulnerability discovered by Gjoko Krstic
References
Changelog
13.04.2022Initial release
14.04.2022Added reference [3]
20.04.2022Added reference [4]
29.05.2022Added reference [5] and [6]