Skip to content

Instantly share code, notes, and snippets.

@stevenyu113228

stevenyu113228/MITRE - Improper Access Control Privilege Escalation Vulnerability in DASAN GPON ONU H660WM.md Secret

Created March 10, 2025 07:02
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save stevenyu113228/fd09d455214193525f5957c4e4046386 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save stevenyu113228/fd09d455214193525f5957c4e4046386 to your computer and use it in GitHub Desktop.
Download ZIP
MITRE - Improper Access Control Privilege Escalation Vulnerability in DASAN GPON ONU H660WM.md
Raw
MITRE - Improper Access Control Privilege Escalation Vulnerability in DASAN GPON ONU H660WM.md

1. Vulnerability Title

Improper Access Control Privilege Escalation Vulnerability in DASAN GPON ONU H660WM

2. High-level overview of the vulnerability and the possible effect of using it

The DASAN GPON ONU H660WM device exhibits a vulnerability related to access control permissions. Low-privileged users can gain access to APIs that are not displayed on the frontend, such as the system diagnostic function and system information page.

3. Exact product that was found to be vulnerable including complete version information

  • Device: DASAN GPON ONU H660WM
  • Operating System: H660WMR210825
  • Hardware Version: DS-E5-583-A1

4. Proof-of-Concept

Under normal circumstances, features like Status / Advanced Setup and Maintenance would not be available to low-privileged users.

User permission view: image

Admin (cht) permission view: image

However, direct URL access to /cgi-bin/system_diagnostic_main.asp, /cgi-bin/status_deviceinfo.asp etc., still allows usage of administrator features.

https://192.168.1.1/cgi-bin/system_diagnostic_main.asp image

https://192.168.1.1/cgi-bin/status_deviceinfo.asp image

6. Credit

Chiao-Lin Yu (Steven Meow)

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment