id: comtrend-password-exposure

info:
  name: Comtrend ADSL - Remote Code Execution
  author: geeknik
  severity: high
  description: Comtrend ADSL CT-5367 C01_R12 router is susceptible to remote code execution. A remote user can execute arbitrary commands via the telnet interface, The password for this interface is leaked to unauthenticated users via the password.cgi endpoint.
  reference:
    - https://www.exploit-db.com/exploits/16275
  metadata:
    max-request: 1
  tags: router,exposure,iot,rce,edb

http:
  - method: GET
    path:
      - "{{BaseURL}}/password.cgi"

    matchers-condition: and
    matchers:
      - type: status
        status:
          - 200

      - type: word
        words:
          - "pwdAdmin ="
          - "pwdSupport ="
          - "pwdUser ="
        condition: and
# digest: 4a0a00473045022100c7827b909e98d510c88cbd5e3e71e0a10308b3914a526f23e91d36dc3a200da5022020872ffbfa8461246b0c7f8b2279e052940f0e926f7344dd6f130670b6e22d87:922c64590222798bb761d5b6d8e72950