PT-2021-17991 · Acexy · Acexy Wireless-N Wifi Repeater

Published 2021-03-29 · Updated 2021-04-02 · CVE-2021-28936

Positive Technologies (AI Summary)

CVSS v3.1

7.5

High

Base vector

AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions: Acexy Wireless-N WiFi Repeater REV 1.0 version 28.08.06.1

Description: The issue allows the administrator password to be changed by sending a specially crafted HTTP GET request. The administrator username, which defaults to admin, must be known, but no previous authentication is required.

Recommendations: For Acexy Wireless-N WiFi Repeater REV 1.0 version 28.08.06.1, consider restricting access to the web management interface until a fix is available. As a temporary workaround, changing the default administrator username admin to a unique and strong username may help minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Incorrect Authorization

Weakness Enumeration

CWE-863

Related Identifiers

CVE-2021-28936

Affected Products

Acexy Wireless-N Wifi Repeater

References · 7

• 🔥 https://blog-ssh3ll.medium.com/acexy-wireless-n-wifi-repeater-vulnerabilities-8bd5d14a2990 · Exploit
• https://osv.dev/vulnerability/CVE-2021-28936 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-28936 · Security Note
• http://acexy.com · Note
• https://t.me/cvenotify/12242 · Telegram Post
• http://wireless-n.com · Note
• https://t.me/cvenotify/12235 · Telegram Post