Seems to be the same vulnerability published time ago http://www.securityfocus.com/bid/9091 On Sat, 19 Feb 2005 10:43:44 +0100, MurDoK <murdok.lnx@xxxxxxxxx> wrote: > I found a vulnerability in this cablemodem which a malicious user inside *LAN > can reset it easily. > This cablemodem model is given by the spanish ISP "AUNA". > > Details > ======= > > Product: Thomson TCW690 cablemodem > Affected Version: ST42.03.0a (possible others) > Immune Version: ??? > Security-Risk: high > Exploit: yes > Product-URL: > http://www.thomson.net/EN/Home/MiniSites/BAP/Cable/ModelDetail.html?category=cab%20modem%20Eurodocsis&model=TCW690 > Vendor-URL: http://www.thomson.net/ > Vendor-Status: informed but no response > > Description > =========== > > The http server inside this cablemodem doesn't check the length of GET > requests. If you exploit this bug the router will become unstable for ~50 > seconds. > > Exploit > ======= > > No code needed. Just open your browser to > http://192.168.0.1/AAAA[about 2000 A's]AAA > > Fix > === > > No response from vendor. There isn't fix available. > > Vendor Status > ============== > 2005.02.07 - Bug found. > 2005.02.07 - Informed the vendor broadband@xxxxxxxxxxx, no response. > 2005.02.11 - Informed the vendor webmaster@xxxxxxxxxxxx > 2005.02.19 - Public disclosure. > _______________________________________________ > Full-Disclosure - We believe in it. > Charter: http://lists.netsys.com/full-disclosure-charter.html > -- Loco de aTar
