SSD Advisory – Coredy CX-E120 Repeater Multiple Vulnerabilities Full report: https://blogs.securiteam.com/index.php/archives/3556 Twitter: @SecuriTeam_SSD Weibo: SecuriTeam_SSD Vulnerabilities Summary The following advisory describes two (2) vulnerabilities found in Coredy CX-E120 Repeater. The Coredy CX-E120 WiFi Range Extender is “a network device with multifunction, which can be using for increasing the distance of a WiFi network by boosting the existing WiFi signal and enhancing the overall signal quality over long distances. An extender repeats the signals from an existing WiFi router or access point.” The vulnerabilities found are: Unauthenticated Root Password Reset Unauthenticated Remote Command Execution Credit An independent security researcher, Corben Douglas (@sxcurity), has reported this vulnerability to Beyond Security’s SecuriTeam Secure Disclosure program Vendor response Coredy has released patches to address these vulnerabilities (WN575A3-A-RPTA3-75W.M4300.01.GD.2017Nov22-WEBC.bin). Vulnerabilities details Unauthenticated Root Password Reset An unauthenticated user is able to send a POST request to /cgi-bin/adm.cgi which can then be used to reset the root password with parameter page=sysAdm, username=, and the values of the new password: newpass= and confpass=. Remote Command Execution An unauthenticated user is able to send a POST request to /cgi-bin/adm.cgi with the following parameters: page=sysCMD, SystemCommandSubmit=Apply, and command= with the command you run to run. The input is passed as root cmd command for execution. -- Thanks Maor Shwartz Beyond Security GPG Key ID: 6D273779F52A9FC2
Attachment:
SSD Advisory – Coredy CX-E120 Repeater Multiple Vulnerabilities.pdf
Description: Adobe PDF document
_______________________________________________ Sent through the Full Disclosure mailing list https://nmap.org/mailman/listinfo/fulldisclosure Web Archives & RSS: http://seclists.org/fulldisclosure/