| शीर्षक | Mercusys Router MW301R 1.0.2 Build 190726 Rel.59423n (4252) 7PK Security Features / Brute Force via IP Cycling |
|---|
| विवरण | Hello team!
The Mercusys MW301R router implements a basic brute-force protection mechanism that blocks login attempts after a number of failed tries. However, this blocking mechanism is based solely on the source IP address, without enforcing any session fingerprinting, token validation, or advanced rate-limiting / and MAC Address, etc.
An attacker connected to the LAN can simply change their local IP address (e.g., from 192.168.1.10 to 192.168.1.11) after reaching the limit, effectively resetting the login attempt counter.
This allows a brute-force attack to be performed against the admin login page, completely defeating the intended security mechanism. |
|---|
| स्रोत | ⚠️ https://github.com/RaulPazemecxas/PoCVulDb/blob/main/README21.md |
|---|
| उपयोगकर्ता | RaulPACXXX (UID 84502) |
|---|
| सबमिशन | 08/07/2025 02:00 PM (1 वर्ष पहले) |
|---|
| संयम | 19/07/2025 09:44 AM (11 days later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 316997 [Mercusys MW301R 1.0.2 Build 190726 Rel.59423n Login सूचना का प्रकटीकरण] |
|---|
| अंक | 20 |
|---|