Pentagram Cerberus P 6363 Router Multiple Security Vulnerabilities
BID:64347
Info
Pentagram Cerberus P 6363 Router Multiple Security Vulnerabilities
| Bugtraq ID: | 64347 |
| Class: | Unknown |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Dec 12 2013 12:00AM |
| Updated: | Dec 12 2013 12:00AM |
| Credit: | condis |
| Vulnerable: |
Pentagram Cerberus P 6363 5.07.28_PEN01 |
| Not Vulnerable: | |
Discussion
Pentagram Cerberus P 6363 Router Multiple Security Vulnerabilities
Pentagram Cerberus P 6363 router is prone to the following security vulnerabilities:
1. An authentication-bypass vulnerability
2. Multiple HTML-injection vulnerabilities
3. A cross-site Request-forgery vulnerability
An attacker can exploit these issues to gain access to bypass certain security restrictions and obtain potentially sensitive information, perform unauthorized administrative actions, steal cookie-based authentication credentials, and gain access to system. Other attacks are also possible.
Pentagram Cerberus P 6363 running firmware 5.07.28_PEN01 is vulnerable; prior versions may also be affected.
Pentagram Cerberus P 6363 router is prone to the following security vulnerabilities:
1. An authentication-bypass vulnerability
2. Multiple HTML-injection vulnerabilities
3. A cross-site Request-forgery vulnerability
An attacker can exploit these issues to gain access to bypass certain security restrictions and obtain potentially sensitive information, perform unauthorized administrative actions, steal cookie-based authentication credentials, and gain access to system. Other attacks are also possible.
Pentagram Cerberus P 6363 running firmware 5.07.28_PEN01 is vulnerable; prior versions may also be affected.
Exploit / POC
Pentagram Cerberus P 6363 Router Multiple Security Vulnerabilities
An attacker can exploit some of these issues through a browser. To exploit the cross-sire request-forgery issue the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example input is available:
filter_mac0=DE:AD:DE:AD:DE:AD,0-6,0-0,on,gangbang');alert('xss');//
filter_url0=192.168.1.12-192.168.1.13:bar,0-6,0-0,on,foo");alert('XSS');//
wl_wpa_psk=wifi_password";alert('XSS');//
An attacker can exploit some of these issues through a browser. To exploit the cross-sire request-forgery issue the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example input is available:
filter_mac0=DE:AD:DE:AD:DE:AD,0-6,0-0,on,gangbang');alert('xss');//
filter_url0=192.168.1.12-192.168.1.13:bar,0-6,0-0,on,foo");alert('XSS');//
wl_wpa_psk=wifi_password";alert('XSS');//
Solution / Fix
Pentagram Cerberus P 6363 Router Multiple Security Vulnerabilities
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or if you are aware of more recent information, please mail us at: [email protected].
References
Pentagram Cerberus P 6363 Router Multiple Security Vulnerabilities
References:
References:
- Pentagram Cerberus P 6363 Product Page (Pentagram)