PT-2017-12009 · Humax · Humax Wi-Fi Router Hg100R-*

Publicado 2017-07-19 · Atualizado 2021-06-21 · CVE-2017-11435

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Humax Wi-Fi Router model HG100R-* version 2.0.6

Description The issue allows for an authentication bypass via specially crafted requests to the management console. This can be exploited remotely when the router exposes the management console. The router fails to validate the session token for certain methods in the "/api" endpoint. An attacker can exploit this to retrieve sensitive information, including private and public IP addresses, SSID names, and passwords.

Recommendations For Humax Wi-Fi Router model HG100R-* version 2.0.6, consider restricting access to the management console to minimize the risk of exploitation. As a temporary workaround, avoid using the "/api" endpoint until a patch is available.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-11435

Produtos afetados

Humax Wi-Fi Router Hg100R-*

Referências · 5

• 🔥 https://exploit-db.com/exploits/42732 · Exploit
• https://trustwave.com/Resources/Security-Advisories/Advisories/Multiple-Vulnerabilities-in-Humax-Routers/?fid=9700 · Nota
• https://hackertor.com/2017/07/19/na-cve-2017-11435-the-humax-wi-fi-router-model-hg100r-2-0-6-is · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-11435 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-11435 · Aviso do Fabricante