PT-2019-18648 · Shenzhen Coship · Shenzhen Coship Wm3300 Wifi Router

Published 2019-05-07 · Updated 2020-08-24 · CVE-2019-7564

Positive Technologies (AI Summary)

CVSS v3.1

9.8

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Shenzhen Coship WM3300 WiFi Router version 5.0.0.55

Description An issue was found where the password reset functionality of the Wireless SSID does not require authentication. This allows an attacker to change the WiFi network password by making a POST request to the "regx/wireless/wl security 2G.asp" URI.

Recommendations For Shenzhen Coship WM3300 WiFi Router version 5.0.0.55, as a temporary workaround, consider disabling the password reset functionality until a patch is available. Restrict access to the "regx/wireless/wl security 2G.asp" URI to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this issue.

Exploit

Fix

Missing Authentication

Weakness Enumeration

CWE-306

Related Identifiers

CVE-2019-7564

Affected Products

Shenzhen Coship Wm3300 Wifi Router

References · 3

• 🔥 http://packetstormsecurity.com/files/151595/Coship-Wireless-Router-4.0.0.x-5.0.0.x-Authentication-Bypass.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2019-7564 · Security Note
• https://osv.dev/vulnerability/CVE-2019-7564 · Vendor Advisory