ZTE MF971R - Referer authentication bypass

mediumseverity

4.3CVSS score

55.7%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould use this vulnerability to perform illegal authorization operations by sending a request to the user to click.

Impact

An attacker can bypass authentication and gain unauthorized access to the router.

Fix

Apply the latest firmware update provided by ZTE to fix the authentication bypass vulnerability.

How to confirm it

Send: GET /goform/goform_get_cmd_process?cmd=psw_fail_num_str
Positive when: matches /psw_fail_num_str":"[0-9]/ AND status 200

Run it with nuclei: nuclei -id CVE-2021-21745 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-21745

info:
  name: ZTE MF971R - Referer authentication bypass
  author: gy741
  severity: medium
  description: |
    ZTE MF971R product has a Referer authentication bypass vulnerability. Without CSRF verification, an attackercould
    use this vulnerability to perform illegal authorization operations by sending a request to the user to click.
  impact: |
    An attacker can bypass authentication and gain unauthorized access to the router.
  remediation: |
    Apply the latest firmware update provided by ZTE to fix the authentication bypass vulnerability.
  reference:
    - https://www.talosintelligence.com/vulnerability_reports/TALOS-2021-1317
    - https://nvd.nist.gov/vuln/detail/CVE-2021-21745
    - https://support.zte.com.cn/support/news/LoopholeInfoDetail.aspx?newsId=1019764
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N
    cvss-score: 4.3
    cve-id: CVE-2021-21745
    cwe-id: CWE-352
    epss-score: 0.55709
    epss-percentile: 0.99047
    cpe: cpe:2.3:o:zte:mf971r_firmware:v1.0.0b05:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: zte
    product: mf971r_firmware
  tags: cve2021,cve,zte,auth-bypass,router,vkev,vuln

http:
  - raw:
      - |
        GET /goform/goform_get_cmd_process?cmd=psw_fail_num_str HTTP/1.1
        Host: {{Hostname}}
        Referer: http://interact.sh/127.0.0.1.html

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - 'psw_fail_num_str":"[0-9]'

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from