Description
BT Voyager 2091 Wireless firmware 2.21.05.08m_A2pB018c1.d16d and earlier, and 3.01m and earlier, allow remote attackers to bypass the authentication process and gain sensitive information, such as configuration information via (1) /btvoyager_getconfig.sh, PPP credentials via (2) btvoyager_getpppcreds.sh, and decode configuration credentials via (3) btvoyager_decoder.c.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- BT Voyager 2091 (Wireless ADSL) - Multiple Vulnerabilities EDB-2034 · remote · Jul 18, 2006 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 20080301 The Router Hacking Challenge is Over! mailing-list
- http://www.gnucitizen.org/projects/router-hacking-challenge/
- http://www.gnucitizen.org/blog/holes-in-embedded-devices-authentication-bypass-pt-3/
- 19057 vdb-entry
- 20060716 Unauthenticated access to BT Voyager config file and PPP credentials embedded in HTML form mailing-list
- 20060708 Unauthenticated access to BT Voyager config file mailing-list
- ADV-2006-2734 vdb-entry
- btvoyager-config-information-disclosure(27652) vdb-entry
- 20982 third-party-advisory
- http://ikwt.dyndns.org/projects/btvoyager-getconfig.txt