| عنوان | Beetel Router Beetel 450TC3 V01.00.00_01 Unverified Password Change |
|---|
| الوصف | Vulnerability Summary
Product: Beetel 450TC3 Router
Firmware Version: V01.00.00_01
Vulnerability Type: Authenticated Privilege Escalation / Improper Authorization (CWE-269)
Description
The router's web management interface contains an authorization flaw in the password change functionality.
A low-privileged authenticated user can change the password of any existing user, including the administrator (root) account, by intercepting and modifying the password change request. During the request, the attacker simply replaces their own username with the administrator's username and submits the request.
Additionally, the application does not require or validate the current (old) password before processing the password change. The server accepts the modified request without verifying that the authenticated user is authorized to change the target account's password.
As a result, a low-privileged user can successfully reset the administrator's password and subsequently authenticate as the administrator. |
|---|
| المصدر | ⚠️ https://github.com/Greejith-k/Authenticated-Privilege-Escalation-Vulnerability-in-Beetel-450TC3-Router |
|---|
| المستخدم | Greejith (UID 99578) |
|---|
| ارسال | 07/07/2026 07:05 AM (2 أشهر منذ) |
|---|
| الاعتدال | 29/08/2026 06:29 PM (2 months later) |
|---|
| الحالة | تمت الموافقة |
|---|
| إدخال VulDB | 397037 [Beetel 450TC3 01.00.00_01 تجاوز الصلاحيات] |
|---|
| النقاط | 20 |
|---|