| Название | Beetel Router Beetel 450TC3 V01.00.00_01 Unverified Password Change |
|---|
| Описание | Vulnerability Summary
Product: Beetel 450TC3 Router
Firmware Version: V01.00.00_01
Vulnerability Type: Authenticated Privilege Escalation / Improper Authorization (CWE-269)
Description
The router's web management interface contains an authorization flaw in the password change functionality.
A low-privileged authenticated user can change the password of any existing user, including the administrator (root) account, by intercepting and modifying the password change request. During the request, the attacker simply replaces their own username with the administrator's username and submits the request.
Additionally, the application does not require or validate the current (old) password before processing the password change. The server accepts the modified request without verifying that the authenticated user is authorized to change the target account's password.
As a result, a low-privileged user can successfully reset the administrator's password and subsequently authenticate as the administrator. |
|---|
| Источник | ⚠️ https://github.com/Greejith-k/Authenticated-Privilege-Escalation-Vulnerability-in-Beetel-450TC3-Router |
|---|
| Пользователь | Greejith (UID 99578) |
|---|
| Представление | 07.07.2026 07:05 (2 месяцы назад) |
|---|
| Модерация | 29.08.2026 18:29 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 397037 [Beetel 450TC3 01.00.00_01 эскалация привилегий] |
|---|
| Баллы | 20 |
|---|