To simplify the “complicated” process, the following Python (3) script allows us to change the administrator password if we have “forgotten it”:

This means that any user who has access to the application’s web interface can change the password of any user of the application and access the router’s administration panel. Simply by modifying the http_passwd field is enough to change the password of the administrator user (admin). The password change request is as follows: These privileges also apply (1 form, double the fun!!) to other router features such as the AiCloud service discussed below. That is, if you know how the request is formed, it is possible to change the access credentials of any user, such as the administrator. In the case of this particular device, one of the few resources I have identified, and perhaps one of the most relevant is the password reset form.

Nothing new nor fancy, our HTML code is executed on the browser and we get our magic pop-up.Ībout the following vulnerability, during the testing period, it is always a good practice is to check that all the resources that require authorization are properly authenticated prior to accessing any of them, due to a misconfiguration or an oversight in the role matrix, lol. This is how the final HTML code looks like after executing the web request: Īs for the vulnerabilities discovered, the first and most boring of these, is a Cross Site Scripting (XSS) that appears when accessing a nonexistent resource without using credentials.įor example, when accessing the resource:

Going into more technical details, the router I bought is an ASUS DSL-N14U B1 whose firmware, at the time of the tests, was in the version “1.1.2.3_345” published on. In the end, one thing leads to another (you know how that goes…), you get involved and when you’re conscious you have Burp or ZAP open, you’ve gone over halfway through OWASP and you’ve been looking for hours for something to play with, something interesting to see how safe your brand-new router is. Then comes a lonely afternoon of boredom, or perhaps out of habit (I wanted to start writing a report:D), so I start by trying a little apostrophe here, a marquee as the Wi-Fi name,, command execution in one of the network diagnostic pages and a long list of etc. Since it is the de facto manufacturer recommended by my ISP, in order to avoid any complications that could lead to delays in getting my Internet up and running I decided to go with it. A few months ago, I changed my old TP-LINK router to an ASUS.

Tplink ac750 exploit