Executive Summary

This vulnerability is a Cross-Site Request Forgery (CSRF) in the V-SOL GPON/EPON OLT Platform version 2.03. It allows attackers to perform administrative actions without the user's consent by tricking authenticated administrators into loading malicious web pages. Because the platform's web interface does not validate the authenticity of HTTP requests, an attacker can craft malicious requests that create admin users, enable SSH, or modify system settings remotely when an authenticated user visits a specially crafted page. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

This vulnerability can impact you by allowing attackers to gain unauthorized administrative control over the affected device. They can create new administrative users, enable SSH access, or change system configurations without your knowledge or consent. This can lead to unauthorized access, potential device compromise, and disruption of services provided by the device. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by monitoring for unauthorized administrative HTTP POST requests to the device's web management interface endpoints such as /action/user.html and /action/sshglobal.html. Specifically, look for POST requests that create new admin users or enable SSH without proper authentication tokens or origin validation. Network traffic inspection tools or web server logs can be used to identify such suspicious requests. Example commands include using curl to simulate or detect these requests, e.g., curl commands that POST to /action/user.html with parameters to add users or to /action/sshglobal.html to enable SSH. Additionally, inspecting web server logs for unexpected POST requests to these endpoints can help detect exploitation attempts. [1]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the web management interface to trusted networks or IP addresses, disabling web-based administrative access if possible, and educating administrators to avoid visiting untrusted websites while logged into the device. Applying any available firmware updates or patches from the vendor that address CSRF protections is recommended. If patches are not available, consider implementing network-level protections such as web application firewalls to block unauthorized POST requests to sensitive endpoints. Additionally, changing default credentials and monitoring for unauthorized administrative changes can help reduce risk. [1, 2]

Useful 0 Not Useful 0