id: comtrend-password-exposure

info:
  name: Comtrend ADSL - Remote Code Execution
  author: geeknik
  severity: high
  description: Comtrend ADSL CT-5367 C01_R12 router is susceptible to remote code execution. A remote user can execute arbitrary commands via the telnet interface, The password for this interface is leaked to unauthenticated users via the password.cgi endpoint.
  reference:
    - https://www.exploit-db.com/exploits/16275
  metadata:
    max-request: 1
  tags: router,exposure,iot,rce,edb

http:
  - method: GET
    path:
      - "{{BaseURL}}/password.cgi"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "pwdAdmin ="
          - "pwdSupport ="
          - "pwdUser ="
        condition: and

# digest: 4b0a00483046022100ad2e20e1ed2593c7488c26ded0b9e5a4dc7ea62dfc3f8b44ae1e1f655b541fb40221009a250931b49d0a39559ceca51f6a97cfd33d25741e2bafc88d4acaedffe6e4db:922c64590222798bb761d5b6d8e72950