IP-COM Multi-WAN Hotspot Router (M50) Vulnerability

IP-COM Multi-WAN Hotspot Router (M50) allow unauthenticated remote attackers to access the configuration file and consequently bypass authentication by directly requesting either http://xxx.yyy.zzz.qqq/cgi-bin/DownloadCfg/RouterCfm.cfg or http://xxx.yyy.zzz.qqq/cgi-bin/DownloadCfg/switch.cfg.
The configuration file contains the administrator password encoded in Base64. A remote attacker can easily decode the administrator password, set up a VPN server, infiltrate the victim's network, and alter DNS records to manipulate requests, redirecting users to malicious sites.

Model: Multi-WAN Hotspot Router M50
Version: V15.01.0.5(3076_839)

Cumhur Kizilari

Comments

Post a Comment

Popular posts from this blog

AvediaServer Unauthorised API Access Vulnerability

Image
Two weeks ago I discovered a security vulnerability in AvediaServer, details of which you can see below. VITEC (formerly Exterity) AvediaServer uses API to list, create and delete users. On the other hand, as you can see, they forgot to implement any authentication to this API. So, if you send the following GET requests to AvediaServer, you can see all users, individual user details with encrypted password (if the user is local) and profiles (admin, asset manager, etc.). Platform details where I found this vulnerability. AvediaServer Product : avsrv-m8105 Platform : mavsrv-c1520 Version : 8.6.2-1 http://hostname/api/auth/users http://hostname/api/auth/users/1 http://hostname/api/auth/profiles You can also create a user with administrative access if you send a POST request using the following parameters. I also used Shodan and Google Dorking and found several devices open to the internet. I found asset owners based on IP address records and I informed them. ...
Read more