UZ801 / ES-U3TS MifiService Broken Access Control

Security advisory and technical notes for a broken access control issue in the embedded web management API exposed by MifiService.apk on the OEM / white-label UZ801_v2.1 4G LTE mobile Wi-Fi platform, also observed marketed as ES-U3TS.

This repository is intended to support coordinated disclosure and CVE assignment. It focuses on reproducible, non-weaponized technical evidence.

Summary

The affected device exposes a Jetty-based HTTP management endpoint at:

http://192.168.100.1/ajax

The backend request dispatcher is implemented in:

com.mifiservice.server.AjaxSevlet

Although the web UI presents a login page, the backend does not enforce a valid authenticated server-side session for most management functions. As a result, an attacker on the adjacent network can directly invoke sensitive funcNo operations without authentication.

Verified impact includes:

extraction of the current Wi-Fi password in cleartext
extraction of IMEI, firmware information, SIM status, and network configuration
extraction of DHCP and MAC filter configuration
modification and persistence of management configuration without authentication
triggering configuration reset and device reboot without authentication

Additional high-risk functions were confirmed by static analysis, including:

reboot to bootloader
enabling hidden ADB / Qualcomm Diag USB modes and rebooting
undocumented IMEI overwrite functionality

Scope and naming

The tested hardware appears to belong to an OEM / white-label device family. The exact original development vendor is currently unknown, and no reliable vendor security contact has been identified so far.

This advisory therefore uses the following product naming:

Platform: UZ801_v2.1
Observed marketing alias: ES-U3TS
Observed firmware: UZ801-V3.4.3
Observed app: MifiService.apk
Observed package: com.mifiservice.hello

If additional brands or resellers are found to ship the same firmware, APK, web assets, and funcNo behavior, they should be treated as likely affected variants of the same codebase.

Affected component

/ajax Web API endpoint
MifiService.apk
com.mifiservice.server.AjaxSevlet

Root cause

This is not primarily a default-credential issue.

The root cause is broken access control in the backend API:

no authenticated server-side session is enforced for most management requests
no CSRF protection is present
no Origin validation is present
no Referer validation is present
no session cookie or token is required for most sensitive functions

The login function exists, but it does not provide meaningful authorization boundaries for the majority of the management API.

Threat model

Primary attack vector:

adjacent network attacker connected to the device hotspot

Secondary attack vector:

browser-based CSRF / drive-by exploitation against a victim currently connected to the device LAN

This is not an internet-exposed remote attack by default. The attacker must either:

have direct Layer 2 / Layer 3 reachability to 192.168.100.1, or
coerce a connected victim browser into sending requests to the device endpoint

Evidence status

All findings below are included as affected functionality of the same broken access control issue.
Where relevant, each item is explicitly marked as either:

Live validated
Confirmed by static analysis

This distinction is preserved for accuracy. High-risk functionality is not mislabeled as live-tested when it was intentionally not executed on public hardware.

Technical findings by function group

Unauthenticated information disclosure

funcNo	Description	Status	Notes
`1002`	Read SSID, device IP, DNS, Wi-Fi password	Live validated	Returns Wi-Fi password in cleartext
`1009`	Read Wi-Fi encryption mode and password	Live validated	Returns Wi-Fi password in cleartext
`1011`	Read DHCP range, DNS, client list	Live validated	Useful for local reconnaissance
`1015`	Read SIM status	Live validated	Returns SIM state
`1029`	Read IMEI, firmware, manufacturer, signal info	Live validated	Returns sensitive device identity
`1052`	Read MAC filter mode and configured entries	Live validated	Leaks policy and configured slots
`2002`	Read active SIM slot	Live validated	Exposes runtime state

Unauthenticated configuration modification

funcNo	Description	Status	Notes
`1004`	Change connection mode	Static confirmed	No session enforcement observed
`1005`	Change preferred network mode	Static confirmed	High operational impact
`1007`	Change SSID / max station count	Static confirmed	Persists config and restarts AP logic
`1010`	Change Wi-Fi encryption mode / password	Static confirmed	High confidentiality impact
`1012`	Change DHCP/DNS-related settings	Static confirmed	Local network tampering
`1016/1017/1018`	APN profile read / set / switch	Static confirmed	WAN behavior modification
`1031`	Change language and persist	Live validated	Used as low-risk proof of write access
`1053/1054/1055`	Change MAC filter behavior and entries	Static confirmed	Network access control tampering

Unauthenticated disruptive / administrative actions

funcNo	Description	Status	Notes
`1013`	Reboot device	Live validated	DoS / service interruption
`1014`	Reset app/network config and reboot	Live validated	Not full Android userdata wipe
`2000`	Reboot to bootloader	Live validated	High operational impact
`2001`	Enable hidden ADB/Diag USB config and reboot	Static confirmed	Dangerous maintenance path

Undocumented or maintenance-style functionality

funcNo	Description	Status	Notes
`2003`	Hidden maintenance password path	Static confirmed	Uses hardcoded `admin8888`; behavior appears partial / residual
`2004`	Overwrite IMEI	Static confirmed	Calls AT command path; not executed publicly

Vendor status

Original upstream vendor: unknown
Product type: OEM / white-label mobile router platform
Reliable PSIRT / security contact: not identified
Current disclosure state: vendor unreachable / no confirmed vendor security channel

At the time of writing, the device appears to be sold through OEM / reseller channels with inconsistent or absent branding, and no trustworthy original development vendor contact has been established.

Safe PoC examples

The examples below are intentionally limited to read-only or low-impact validation. They are included to demonstrate the vulnerability without providing a weaponized exploitation workflow.

1. Read current Wi-Fi password without authentication

curl -s \
  -H "Content-Type: application/json" \
  -d '{"funcNo":1002}' \
  http://192.168.100.1/ajax

Expected behavior:

returns JSON
includes ssid
includes pwd in cleartext

2. Read device identifier information without authentication

curl -s \
  -H "Content-Type: application/json" \
  -d '{"funcNo":1029}' \
  http://192.168.100.1/ajax

Expected behavior:

returns JSON
includes imei
includes fwversion

3. Demonstrate unauthorized persistent write access using a low-risk field

Read current language:

curl -s \
  -H "Content-Type: application/json" \
  -d '{"funcNo":1030}' \
  http://192.168.100.1/ajax

Set language:

curl -s \
  -H "Content-Type: application/json" \
  -d '{"funcNo":1031,"Language":"Chinese"}' \
  http://192.168.100.1/ajax

Restore original value afterward.

4. Browser-based CSRF concept

This endpoint does not enforce session state or Origin / Referer validation. A connected victim browser can therefore be abused to send background requests.

Minimal demonstration page:

CVE-2026-52200

Most Popular