Genexis Platinum-4410 2.1 - Authentication Bypass
| Reporter | Title | Published | Views | Family All 15 |
|---|---|---|---|---|
 | Genexis Platinum-4410 2.1 - Authentication Bypass Vulnerability | 24 Jan 202000:00 | – | zdt |
 | CVE-2020-6170 | 8 Jan 202006:15 | – | attackerkb |
 | Genexis Platinum-P4410-V2 cgi-bin/index2.asp Authentication Information Disclosure | 3 Feb 202000:00 | – | bdu_fstec |
 | Genexis Platinum-4410 Certification Bypass Vulnerability | 8 Jan 202000:00 | – | cnvd |
 | CVE-2020-6170 | 8 Jan 202005:30 | – | cve |
 | CVE-2020-6170 | 8 Jan 202005:30 | – | cvelist |
 | Genexis Platinum-4410 2.1 - Authentication Bypass | 24 Jan 202000:00 | – | exploitdb |
 | EUVD-2020-27322 | 7 Oct 202500:30 | – | euvd |
 | CVE-2020-6170 | 8 Jan 202006:15 | – | nvd |
 | CVE-2020-6170 | 8 Jan 202006:15 | – | osv_cve |
10
# Exploit Title: Genexis Platinum-4410 2.1 - Authentication Bypass
# Date: 20220-01-08
# Exploit Author: Husinul Sanub
# Author Contact: https://www.linkedin.com/in/husinul-sanub-658239106/
# Vulnerable Product: Genexis Platinum-4410 v2.1 Home Gateway Router https://genexis.co.in/product/ont/
# Firmware version: P4410-V2–1.28
# Vendor Homepage: https://genexis.co.in/
# Reference: https://medium.com/@husinulzsanub/exploiting-router-authentication-through-web-interface-68660c708206
# CVE: CVE-2020-6170
Vulnerability Details
======================
Genexis Platinum-4410 v2.1 Home Gateway Router discloses passwords of each users(Admin,GENEXIS,user3) in plain text behind login page source “http://192.168.1.1/cgi-bin/index2.asp". This could potentially allow a remote attacker access sensitive information and perform actions such as reset router, changing passwords, upload malicious firmware etc.
How to reproduce
===================
Suppose 192.168.1.1 is the router IP and check view page source of login page “http://192.168.1.1/cgi-bin/index2.asp",There we can found passwords for each login accounts in clear text.
POC
=========
* https://youtu.be/IO_Ez4XH-0YData
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
24 Jan 2020 00:00Current
0.6Low risk
Vulners AI Score0.6
EPSS0.07329