Compal CH7465LG-LC modem/router multiple vulnerabilities
The web interface uses cookies, but is not verified. Thus, if admin login is successful, the IP address and the browser type of the admin user are stored and everybody can access the management interface with the same IP and the same user-agent. Some information requests can be performed without authentication. For example an attacker can obtain the following information pieces: Global settings (SW version, vendor name, etc.), CSRF token, Event log, LAN user table, Ping response. Factory reset can be initiated without authentication with a simple POST request to the getter.xml. Some settings modification can be performed without authentication, for example the first install flag and the ping command. The ping diagnostic function is vulnerable to system command injection, because parameters are checked only at the client side. Using the following ping target, the attacker can gain local root access to the device: “token=<csrf_token>&fun=126&Type=0&Target_IP=127.0.0.1&Ping_Size=64;nc -l -p 1337 -e /bin/sh;&Num_Ping=3&Ping_Interval=1”
