Hitron CGNV4 modem/router multiple vulnerabilities
The web interface uses insecure cookies, which can be brute-forced easily (e.g cookie: userid=0). If admin login is successful, the IP address of the admin user is stored and everybody can access the management interface with the same IP. The web interface is not used any CSRF protection. In case of a valid session exists, the attacker can modify any settings of the router. If the default admin password was not changed, the attacker can perform a login also and modify any settings after it. The ping diagnostic function is vulnerable to system command injection, because the parameters are checked only at the client side. Using the following ping target, the attacker can gain local root access to the device: “google.com;nc -l -p 1337 -e /bin/sh;echo”.
