id: CVE-2014-2321 info: name: ZTE Cable Modem Web Shell author: geeknik severity: high description: | ZTE F460 and F660 cable modems allows remote attackers to obtain administrative access via sendcmd requests to web_shell_cmd.gch, as demonstrated by using "set TelnetCfg" commands to enable a TELNET service with specified credentials. reference: - https://yosmelvin.wordpress.com/2017/09/21/f660-modem-hack/ - https://jalalsela.com/zxhn-h108n-router-web-shell-secrets/ - https://nvd.nist.gov/vuln/detail/CVE-2014-2321 classification: cve-id: CVE-2014-2321 tags: iot,cve,cve2014,zte requests: - method: GET path: - "{{BaseURL}}/web_shell_cmd.gch" matchers-condition: and matchers: - type: word words: - "please input shell command" - "ZTE Corporation. All rights reserved" part: body condition: and - type: status status: - 200 # Enhanced by mp on 2022/04/01