发布 2019-12-30 漏洞条目

Heatmiser Netmonitor 3.03 – Hardcoded Credentials

Exploit Source

# Exploit Title: Heatmiser Netmonitor 3.03 - Hardcoded Credentials

# Date: 2019-12-22

# Exploit Author: Ismail Tasdelen

# Vendor Homepage: https://www.heatmiser.com/en/

# Hardware Link: https://www.zoneregeling.nl/heatmiser/netmonitor-handleiding.pdf

# Software: Netmonitor v3.03

# Product Version: Netmonitor v3.03

# CWE : CWE-798

# Vulenrability: Use of Hard-coded Credentials

# CVE: N/A

# Decription :

# Hard-coded Credentials security vulnerability of Netmonitor model v3.03

# from Heatmiser manufacturer has been discovered. With this

# vulnerability, the hidFrm form in the source code of the page

# anonymously has access to hidden input codes. This information is

# contained in the input field of the hidFrm form in the source code

# lognm and logpd.

HTTP GET Request : /networkSetup.htm HTTP/1.1

</form>

相关漏洞条目