PT-2021-15413 · Mercusys · Mercusys Mercury X18G

Published 2021-01-07 · Updated 2021-01-12 · CVE-2021-23241

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions MERCUSYS Mercury X18G version 1.0.5

Description The issue allows Directory Traversal via ../ in conjunction with a loginLess or login.htm URI to the web server, enabling authentication bypass. This is demonstrated by the /loginLess/../../etc/passwd URI, which showcases the vulnerability.

Recommendations For MERCUSYS Mercury X18G version 1.0.5, consider restricting access to the loginLess and login.htm URIs as a temporary workaround until a patch is available. Additionally, avoid using the ../ sequence in conjunction with these URIs to minimize the risk of exploitation.

Exploit

Fix

Path traversal

Weakness Enumeration

CWE-22

Related Identifiers

CVE-2021-23241

Affected Products

Mercusys Mercury X18G

References · 7

• 🔥❌ https://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Web%20Server%20Directory%20Traversal.md · Exploit, Deleted
• https://nvd.nist.gov/vuln/detail/CVE-2021-23241 · Security Note
• https://mercurycom.com.cn/product-521-1.html · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-23241 · Vendor Advisory
• https://mercusys.com/en · Vendor Advisory
• https://t.me/cibsecurity/21795 · Telegram Post
• https://t.me/cvenotify/8294 · Telegram Post