Detection Guidance

This vulnerability can be detected by attempting to access the web interface of the affected TOZED ZLT M30S and ZLT M30S PRO devices on the local network using the hard-coded credentials: username "guest" and password "123456". Since the web interface allows administrative access with these credentials, a simple test is to try logging in via a web browser or using command-line tools like curl or wget to verify access. For example, you can use the following command to test login via curl: curl -u guest:123456 http://<device-ip>/admin Replace <device-ip> with the IP address of the device. Successful authentication indicates the presence of the vulnerability. [2]

Useful 0 Not Useful 0

Executive Summary

This vulnerability exists in the Web Interface component of TOZED ZLT M30S and ZLT M30S PRO devices (versions 1.47/3.09.06). It involves manipulation that leads to hard-coded credentials being exposed or used. The attack must be initiated from within the local network. The vulnerability has been publicly disclosed and the vendor did not respond to the disclosure.

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized access to the affected devices via hard-coded credentials, potentially allowing an attacker on the local network to fully compromise the device's confidentiality, integrity, and availability. This could result in loss of control over the device and exposure of sensitive information.

Useful 0 Not Useful 0

Mitigation Strategies

There are no known patches or countermeasures available from the vendor, as they did not respond to the disclosure. Immediate mitigation steps include replacing the affected TOZED ZLT M30S and ZLT M30S PRO devices with alternative products that are not vulnerable. Additionally, restrict access to the local network where these devices reside to trusted users only, and monitor for unauthorized access attempts. Since the exploit requires local network access, network segmentation and access controls can help reduce risk. [1]

Useful 0 Not Useful 0