Heatmiser Netmonitor 3.03 – Hardcoded Credentials - 体验盒子

作者： Ismail Tasdelen

日期： 2019-12-30

类别：

webapps

平台：

hardware

来源：https://www.exploit-db.com/exploits/47823/

1

2

3

4

5

6

7

8

9

10

11

12

13

14

15

16

17

18

19

20

21

22

23

24

25

26

27

28

29

30

31

32

33

34

35

# Exploit Title: Heatmiser Netmonitor 3.03 - Hardcoded Credentials

# Date: 2019-12-22

# Exploit Author: Ismail Tasdelen

# Vendor Homepage: https://www.heatmiser.com/en/

# Hardware Link: https://www.zoneregeling.nl/heatmiser/netmonitor-handleiding.pdf

# Software: Netmonitor v3.03

# Product Version: Netmonitor v3.03

# CWE : CWE-798

# Vulenrability: Use of Hard-coded Credentials

# CVE: N/A

# Decription :

# Hard-coded Credentials security vulnerability of Netmonitor model v3.03

# from Heatmiser manufacturer has been discovered. With this

# vulnerability, the hidFrm form in the source code of the page

# anonymously has access to hidden input codes. This information is

# contained in the input field of the hidFrm form in the source code

# lognm and logpd.

HTTP GET Request : /networkSetup.htm HTTP/1.1

</form>