ZTE ZXDSL 831CII – Improper Access Restrictions

• Exploit Database
• 100 阅读

• 作者： Ibad Shah
  日期： 2017-11-27
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/43188/

• # Exploit Title: ZTE ZXDSL 831 Unauthorized Configuration Access
  # Date: 27/11/2017
  # Exploit Author: Ibad Shah
  # Vendor Homepage: zte.com.cn
  # Software Link: -
  # Version: - ZXDSL - 831CII
  # Tested on: Windows 10
  # CVE :- 2017-16953
  
  ======================================= 
  The Router usually servers html files & are protected with HTTP Basic
  Authentication. However, the CGI files does not protect this file from
  getting exposed to public. A Simple GET request would be needed to
  made to router that would give a remote attacker an opportunity to
  modify router PPPoE configurations, setup malicious configurations
  which later could lead to disrupt network & its activities.
  
  
  Proof Of Concept
  ================
  http://192.168.1.1/connoppp.cgi
  

  Python

  Copy