| 제목 | UNIWAY ROUTERS Router Firmware V2.0 CROSS SITE REQUEST FORGERY |
|---|
| 설명 | Dear Team,
I trust this message finds you all in good spirits.
I wish to bring to your attention a recently discovered vulnerability in the Uniway router's firmware (Device Model: UW-302VP). It has come to light that the router lacks the utilization of cookies or any headers for authentication, thereby exposing it to CSRF (Cross-Site Request Forgery) exploitation.
Official Website: http://www.uniwayinfo.com
This vulnerability could potentially enable an attacker to:
- Modify WiFi device details such as SSID
- Change the router's password
- Establish a custom WPS PIN (which could subsequently be exploited for password cracking)
- Initiate a router reboot, among other potential actions.
For your reference, I have enclosed a Proof of Concept video that demonstrates this vulnerability.
Thank you for your consideration.
Warm regards, Faiyaz Ahmad |
|---|
| 원천 | ⚠️ https://drive.google.com/file/d/15Wr3EL4cpAS_H_Vp7TuIftssxAuzb4SL/view?usp=sharing |
|---|
| 사용자 | faiyazahmad (UID 60242) |
|---|
| 제출 | 2023. 12. 15. PM 09:55 (2 연령 ago) |
|---|
| 모더레이션 | 2023. 12. 24. AM 09:00 (8 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 248939 [Uniway UW-302VP 2.0 Admin Web Interface wlan_basic_set.cgi wlanssid/password 교차 사이트 요청 위조] |
|---|
| 포인트들 | 20 |
|---|