Executive Summary

Vodafone H500s devices running firmware v3.5.10 expose the WiFi access point password through an unauthenticated HTTP endpoint. An attacker can send a specially crafted GET request to /data/activation.json with certain headers and cookies to retrieve a JSON document containing the wifi_password field. This means anyone without authentication can obtain the WiFi credentials.

Useful 0 Not Useful 0

Impact Analysis

This vulnerability allows an unauthenticated remote attacker to gain unauthorized access to your wireless network by obtaining the WiFi password. This compromises the confidentiality of your network traffic and any systems connected to the network, potentially leading to further unauthorized access or data breaches.

Useful 0 Not Useful 0

Detection Guidance

You can detect this vulnerability by sending an unauthenticated HTTP GET request to the endpoint /data/activation.json on Vodafone H500s devices running firmware v3.5.10. If the device responds with a JSON document containing the wifi_password field, it is vulnerable. For example, you can use the following curl command: curl -v http://<device-ip>/data/activation.json -H "Specific-Headers" -b "Specific-Cookies". Replace <device-ip> with the target device's IP address and include the required headers and cookies as needed.

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the vulnerable endpoint by implementing network-level controls such as firewall rules to block unauthenticated HTTP requests to /data/activation.json, updating the device firmware if a patch is available, or disabling the vulnerable service if possible to prevent unauthorized retrieval of WiFi credentials.

Useful 0 Not Useful 0