Vulnerabilities in Callisto 821+R3 ADSL Router

Type securityvulns
Reporter Securityvulns
Modified 2015-10-25T00:00:00


Hello 3APA3A!

After all my advisories about vulnerabilities in Callisto 821+ ( and recent advisory about Callisto 821+R3, here is new one. Because vendor ignored in 2011 all my letters and subsequent my public disclosure of vulnerabilities and new devices are vulnerable as well, so I disclosed vulnerabilities in Callisto 821+R3 ADSL Router.

These are Cross-Site Request Forgery vulnerabilities. The whole control panel is vulnerable to CSRF, here are two vulnerabilities.

SecurityVulns ID: 11700.

Affected products:

Vulnerable is the next model: Callisto 821+R3, Firmware Version: ZXDSL 831IIV7.5.1a_E09_UA. This model with other firmware and also other models of Callisto also must be vulnerable.


Cross-Site Request Forgery (WASC-09):

For changing login and password of admin:


For changing login and password of user:


Parameters sysPassword and usrPassword contain encrypted password. The cipher is simple - this is hex values of chars in reverse order.

I mentioned about these vulnerabilities at my site (

Best wishes & regards, MustLive Administrator of Websecurity web site