| 제목 | Beetel Router Beetel 450TC3 V01.00.00_01 Unverified Password Change |
|---|
| 설명 | Vulnerability Summary
Product: Beetel 450TC3 Router
Firmware Version: V01.00.00_01
Vulnerability Type: Authenticated Privilege Escalation / Improper Authorization (CWE-269)
Description
The router's web management interface contains an authorization flaw in the password change functionality.
A low-privileged authenticated user can change the password of any existing user, including the administrator (root) account, by intercepting and modifying the password change request. During the request, the attacker simply replaces their own username with the administrator's username and submits the request.
Additionally, the application does not require or validate the current (old) password before processing the password change. The server accepts the modified request without verifying that the authenticated user is authorized to change the target account's password.
As a result, a low-privileged user can successfully reset the administrator's password and subsequently authenticate as the administrator. |
|---|
| 원천 | ⚠️ https://github.com/Greejith-k/Authenticated-Privilege-Escalation-Vulnerability-in-Beetel-450TC3-Router |
|---|
| 사용자 | Greejith (UID 99578) |
|---|
| 제출 | 2026. 07. 07. AM 07:05 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 08. 29. PM 06:29 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 397037 [Beetel 450TC3 01.00.00_01 권한 상승] |
|---|
| 포인트들 | 20 |
|---|