ZYXEL P-660HN-T1A Router – Authentication Bypass

• Exploit Database
• 17 阅读

• 作者： Michael Grifalconi
  日期： 2014-03-12
• 类别：

  • webapps
  平台：

  • hardware
• 来源：https://www.exploit-db.com/exploits/32204/

• # Exploit Title: ZyXEL Router P-660HN-T1A - Login Bypass
  # Date: 11/03/2013
  # Exploit Author: Michael Grifalconi <NAME.SURNAME@studenti.unimi.it>
  # Vendor Homepage: http://www.zyxel.com/products_services/p_660hn_txa_series.shtml?t=p
  # Version: 3.40(BYF.5) - (Last avaiable)
  
  If someone is logged on the web interface of the router, the attacker could 
  bypass the login form by going straigt to the default page of administration.
  (The root page will ask for password)
  
  The vulnerability works from any IP address, the router seems to be 'free to access' from any IP 
  when a legit user is logged in.
  
  http://ROUTER-IP/rpSys.html
  
  You may setup a bot that checks if someone is logged and if so, download the configuration backup
  to obtain the password.