|
Brought to you by:
Suppliers of:
|
|
|
| |
"ZyXEL's P-2000W VoIP Wi-Fi phone, compatible with IEEE 802.11b wireless standard, is a perfect solution for Voice over IP applications."
An undocumented open port and a static DNS record allow attackers to gain information, DoS and perform Man In the Middle attack against Zyxel's P2000W VoIP Wifi phone. |
| |
Credit:
The information has been provided by Shawn Merdinger.
|
| |
Vulnerable Systems:
* Zyxel P2000W version 1 firmware version Wj.00.10
Open Port:
The Zyxel P2000W VOIP WIFI phone has an undocumented port, UDP/9090, that provides an unauthenticated attacker information about the phone, specifically the phone's MAC address and software version is returned upon connection. An attacker can use this information for easily identify the phone and software version. Also, the undocumented open port provide an avenue for DoS.
Static DNS:
The Zyxel P2000W v.1 VOIP WIFI phone uses hard coded DNS servers located in Taiwan for the phone's DNS configuration.
Primary DNS IP is 168.95.1.1 resolving to dns.hinet.net
Secondary DNS IP is 139.175.55.244 resolving to dns.seed.net.tw
This configuration places every ZyXel phone using this software at risk of unintentional DoS if the DNS servers in Taiwan become unavailable. If the DNS servers are compromised, all Zyxel phone users worldwide are vulnerable to being redirected to malicious SIP servers, etc.
Workaround:
Users can manually input the IP address of a known, trusted DNS server via the keyboard at each phone start when configured for DHCP or PPOE, however, this will not persist once the phone is restarted.
|
|
|
|
|
