ZTE 831CII Multiple Vulnerablities

[habte.yibelo@xxxxxxxxx]

Hardcoded default misconfiguration - The modem comes with admin:admin user 
credintials.

Stored XSS - 
http://192.168.1.1/psilan.cgi?action=save&ethIpAddress=192.168.1.1&ethSubnetMask=255.255.255.0&hostname=ZXDSL83C1II&domainname=home%27;alert%280%29;//&enblUpnp=1&enblLan2=0
Any user browsing to http://192.168.1.1/main.html will have a stored xss 
executed!

CSRF based Stored XSS - 
http://192.168.1.1/adminpasswd.cgi?action=save&sysUserName=%27;alert%280%29;//&sysPassword=37F6E6F627B6
 - letting an admin visit this link would result the admin username changed to 
';alert(0);// also a stored XSS in the home page.

CSRF - there is no token/capcha or even current password prompt when the admin 
changes the password, and creditintials are sent over GET. PoC: 
http://192.168.1.1/adminpasswd.cgi?action=save&sysUserName=admin&sysPassword=F6C656269697
if an authenticated admin browses that link their credintials will become 
admin:yibelo

UI Redressing - The modem (like most modems) does not have a clickjacking 
protection. thus, can be used to modify settings, override admin accounts by a 
simple clickjack. forexample by using http://192.168.1.1/adminpasswd.html it is 
possible into tricking an admin submit a form with our credintials (since it 
doesn't require current password)

not using SSL - The modem does not use HTTPS, so anyone can use MiTM to sniff 
on going actions, possibly gain user credintials.

Unrestricted privileges - anyone who is connected to the modem with Telnet or 
tftp is root. simply telneting and authenticating as admin:admin and typing sh 
and echo $USER would prove that.