Description
H3C 企业路由器存在任意用户登录和命令执行漏洞，攻击者可通过访问nserLogin.asp/actionpalicy_status1./ER3100G2.cfg 接口，ER3100G2为设备型号，统过COOKIE 验证，进行目录穿越，获取设备的明文配置文件，配置中有明文的 web 管理员账号admin 的密码，登陆后台即可通过开启 telenet 获取命令执行权限.
H3C /userLogin.asp/../actionpolicy_status/../ER3100G2.cfg 信息泄露漏洞（CVE-2023-5142）
PoC
None yet. Search at https://trap.biu.life/?ref=rssReferences
https://nvd.nist.gov/vuln/detail/CVE-2023-5142
https://github.com/kuangxiaotu/CVE-H3C-Report
https://vuldb.com/?id.240238
https://blog.csdn.net/weixin_44106034/article/details/133934299
https://www.vicarius.io/vsociety/vulnerabilities/cve-2023-5142
https://cve.akaoma.com/cve-2023-5142
https://access.redhat.com/security/cve/cve-2023-5142
https://avd.aquasec.com/nvd/2023/cve-2023-5142/