PT-2019-18070 · China Mobile · Chinamobile Plc Wireless Router Gpn2.4P21-C-Cn

Kumar Saurav · Published 2019-03-19 · Updated 2019-10-24 · CVE-2019-6282

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00

Description The issue allows an attacker to change the Wireless Security Password due to a CSRF vulnerability via the "cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity" URI.

Recommendations For ChinaMobile PLC Wireless Router GPN2.4P21-C-CN version W2001EN-00, as a temporary workaround, consider restricting access to the "cgi-bin/webproc?getpage=html/index.html subpage=wlsecurity" URI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2019-6282

Affected Products

Chinamobile Plc Wireless Router Gpn2.4P21-C-Cn

References · 7

• 🔥 https://exploit-db.com/exploits/46581 · Exploit
• 🔥 https://youtube.com/watch?v=x-r4lnWPdzY · Exploit
• 🔥 http://packetstormsecurity.com/files/152167/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Request-Forgery.html · Exploit
• 🔥 http://packetstormsecurity.com/files/151275/PLC-Wireless-Router-GPN2.4P21-C-CN-Cross-Site-Request-Forgery.html · Exploit
• https://osv.dev/vulnerability/CVE-2019-6282 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-6282 · Security Note
• https://0dayfindings.home.blog/2019/01/15/plc-wireless-router-gpn2-4p21-c-cn-cross-site-request-forgery-csrf · Note