Executive Summary

This vulnerability affects the TOZED ZLT M30s device firmware up to version 1.47. It exists in the Web Management Interface, specifically in the /reqproc/proc_post file. By manipulating the 'goformId' argument, an attacker can remotely cause information disclosure without authentication. This improper handling allows unauthorized actors to access sensitive information, including configuration data and administrative credentials in plaintext, leading to a breach of confidentiality. [1, 2]

Useful 0 Not Useful 0

Impact Analysis

The vulnerability can lead to unauthorized disclosure of sensitive device information, including administrative account credentials in plaintext. This enables an attacker to gain full access to the device's web management interface remotely without authentication, potentially compromising the device's security and control, leading to further exploitation or network compromise. [1, 2]

Useful 0 Not Useful 0

Detection Guidance

This vulnerability can be detected by sending HTTP requests to the affected device's web management interface, specifically targeting the endpoint `/reqproc/proc_post` with manipulated parameters. For example, sending a request with the parameters `isTest=false` and `goformId=export_information` without authentication can reveal sensitive information if the device is vulnerable. A simple detection command using curl would be: curl -X POST 'http://<device-ip>/reqproc/proc_post' -d 'isTest=false&goformId=export_information' If the response contains sensitive configuration data or administrative credentials in plaintext, the device is vulnerable. [2]

Useful 0 Not Useful 0

Mitigation Strategies

Immediate mitigation steps include restricting access to the device's web management interface to trusted networks only, such as by using firewall rules or network segmentation. Since no vendor patch or countermeasure is available and the vendor did not respond, it is recommended to consider replacing the affected TOZED ZLT M30s device with a secure alternative. Monitoring network traffic for exploitation attempts and disabling remote management if possible are also advisable. [1]

Useful 0 Not Useful 0

Compliance Impact

The vulnerability leads to unauthorized disclosure of sensitive information, including administrative credentials in plaintext, which compromises confidentiality. Such information disclosure can result in non-compliance with data protection standards and regulations like GDPR and HIPAA that mandate protection of sensitive data and proper access controls. Therefore, this vulnerability negatively impacts compliance with these common standards by exposing sensitive data to unauthorized parties. [1, 2]

Useful 0 Not Useful 0