| शीर्षक | Edimax BR-6428nC v1.16 Open Redirect |
|---|
| विवरण | Vulnerability Title: Open Redirect in Multiple goform Handlers of Edimax BR-6428nC via submit-url
Discovered by: tzh00203
Contact Information: [email protected]
Affected Version: Edimax BR-6428nC firmware based on the provided GPL source package (the exact public firmware version string should be confirmed on the test image before submission)
Component: boa form handlers using websRedirect(), such as formStats
1. Vulnerability Overview
An open redirect vulnerability exists in multiple goform handlers of Edimax BR-6428nC. These handlers read a user-controlled submit-url parameter and pass it directly to websRedirect(), which ultimately emits it as the Location header if it already begins with http://.
This behavior enables an attacker to redirect a victim from the router interface to an arbitrary attacker-controlled external site.
2. Detailed Description
Several handlers follow the same pattern:
submitUrl = websGetVar(wp, T("submit-url"), T(""));
if (submitUrl[0])
websRedirect(wp, submitUrl);
Representative examples include:
formStats
formReboot
formRoute
several VPN and management handlers
The redirect implementation is:
int websRedirect(request *req, char *url)
{
send_redirect_perm(req, url);
}
The underlying redirect function only rewrites relative paths:
if (strstr(url, T("http://")) == NULL) {
...
sprintf(urlbuf, "http://%s/%s", req->host, url);
url = urlbuf;
}
Therefore, if the attacker directly supplies an absolute http://attacker.example/ URL, the application keeps it unchanged and returns it in the Location header.
Impact
Open redirect from trusted router origin to arbitrary external site
Phishing assistance
UI redress and social engineering support
3. Affected Versions
This issue affects Edimax BR-6428nC firmware builds containing the submit-url to websRedirect() pattern in the provided GPL source package.
The exact public firmware version string should be verified before final CVE submission.
4. Steps to Reproduce
Send a request to a vulnerable form handler that consumes submit-url.
Set submit-url to an absolute external http:// URL.
Observe the router respond with a redirect to the attacker-controlled site.
5. PoC
Representative example using formStats:
curl -i -X POST "http://192.168.2.1/goform/formStats" \
-d 'submit-url=http://attacker.example/'
Expected Result
The response contains a Location header similar to:
Location:http://attacker.example/
6. Suggested Fix
To fix this vulnerability:
Reject absolute external URLs in submit-url.
Restrict redirects to a fixed allowlist of local application paths.
Normalize redirect targets before use.
Prefer server-side fixed redirects instead of user-controlled redirect targets.
7. Contact Information
Vulnerability Reporter: tzh00203
Email: [email protected] |
|---|
| स्रोत | ⚠️ https://tzh00203.notion.site/Edimax-BR-6428nC-Open-Redirect-via-submit-url-33db5c52018a808a8c34c1cb68db7aab |
|---|
| उपयोगकर्ता | tian (UID 93438) |
|---|
| सबमिशन | 27/07/2026 12:05 PM (2 महीनों पहले) |
|---|
| संयम | 23/09/2026 09:30 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 409175 [Edimax BR-6428nC 1.16 goform websRedirect submit-url] |
|---|
| अंक | 17 |
|---|