Security Advisory AA-006: Authorization Bypass Vulnerability in Password Reset Function Sitecom Home Storage Center (0-day)
An attacker can log into the web management UI with an arbitrarily chosen password. Possibilities include but are not limited to reading and writing files stored on the device and altering the device’s configuration. This means an attacker could steal sensitive data stored on the device, leverage the device to drop and/or host malware, abuse the device to send spam through the victim’s Internet connection, and use the device as a pivot point to access locally connected systems or launch attacks directed to other systems. The function that is responsible for changing the administrator password can be called by an unauthenticated used. It uses the flawed assumption that the call is part of an admin session if a static valued cookie is present. Note that the cookie value is checked on the client so it can be easily circumvented by a command line tool.
