BT Wifi Extenders 300 / 600 / 1200 Cross Site Scripting

`BT Wifi Extenders - 300, 600 and 1200 models - Cross Site Scripting  
leading to disclosure of PSK.  
  
A firmware update is required to resolve this issue.  
  
The essential problem is that if you hit the following URL on your  
wifi extender, it will pop up a whole load of private data, including  
your PSK. Instead of doing a pop up, we could exfiltrate that data to  
our server.  
  
/cgi-bin/webproc?%3Asessionid=deadbeef&obj-action=auth&%3Aaction=login&errorpage=html%2Fmain.html&getpage=html/index.html&var:menu=advanced&var:page=conntorouter&var%3Amenu=setup19497%22%3bsetTimeout(function(){alert(%22If%20you%20see%20stuff%20here,%20patch%21%20%22%2bG_arrClient)%3b},1000)%3bvar+foo%3d%22&var%3Asubpage=-  
  
We can automate this within a web page to steal your stuff and I've  
banged together a quick proof of concept here - http://xjs.io/bt.html  
- which will try to find all the BT wifi extenders on your home  
network, but needs to be run in Chrome. This uses Chrome to get the  
list of local network interfaces and then chucks the XSS around the  
whole local network if it finds any. (If it doesn't work, I apologise  
- you'll have to try it by hand instead.)  
  
If you have one of these, you should upgrade - the details are here:  
  
300 model:  
  
http://bt.custhelp.com/app/answers/detail/a_id/54345  
  
600 model:  
  
http://bt.custhelp.com/app/answers/detail/a_id/51867  
  
1200 model:  
  
http://bt.custhelp.com/app/answers/detail/a_id/56465  
  
  
More details here:  
https://www.pentestpartners.com/blog/bt-wi-fi-extender-multiple-security-issues-upgrade-asap/  
  
  
BT were quite responsive, however seem have just categorised the issue  
as "bug fixes", and I don't think there's an auto-update feature,  
hence this post.  
  
cheers,  
Jamie  
`