17 lines
No EOL
748 B
Text
17 lines
No EOL
748 B
Text
# Exploit Title: ZyXEL Router P-660HN-T1A - Login Bypass
|
|
# Date: 11/03/2013
|
|
# Exploit Author: Michael Grifalconi <NAME.SURNAME@studenti.unimi.it>
|
|
# Vendor Homepage: http://www.zyxel.com/products_services/p_660hn_txa_series.shtml?t=p
|
|
# Version: 3.40(BYF.5) - (Last avaiable)
|
|
|
|
If someone is logged on the web interface of the router, the attacker could
|
|
bypass the login form by going straigt to the default page of administration.
|
|
(The root page will ask for password)
|
|
|
|
The vulnerability works from any IP address, the router seems to be 'free to access' from any IP
|
|
when a legit user is logged in.
|
|
|
|
http://ROUTER-IP/rpSys.html
|
|
|
|
You may setup a bot that checks if someone is logged and if so, download the configuration backup
|
|
to obtain the password. |