id: comtrend-password-exposure

info:
  name: Comtrend ADSL - Remote Code Execution
  author: geeknik
  severity: high
  description: Comtrend ADSL CT-5367 C01_R12 router is susceptible to remote code execution. A remote user can execute arbitrary commands via the telnet interface, The password for this interface is leaked to unauthenticated users via the password.cgi endpoint.
  reference:
    - https://www.exploit-db.com/exploits/16275
  tags: router,exposure,iot,rce,edb

requests:
  - method: GET
    path:
      - "{{BaseURL}}/password.cgi"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "pwdAdmin ="
          - "pwdSupport ="
          - "pwdUser ="
        condition: and

# Enhanced by md on 2022/10/04