medium6.5Public exploit code
CVE-2020-25015
A specific router allows changing the Wi-Fi password remotely.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Genexis Platinum-4410 P4410-V2-1.28 - Broken Access Control and CSRF2020-11-09 · webapps · hardware
Impact
A specific router allows changing the Wi-Fi password remotely. Genexis Platinum 4410 V2-1.28, a compact router generally used at homes and offices was found to be vulnerable to Broken Access Control and CSRF which could be combined to remotely change the WIFI access point’s password.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Genexis | Platinum 4410 Firmware | Version p4410-v2-1.28 |
Weakness classification
References
- NVD record
- CVE.org record
- http://packetstormsecurity.com/files/159936/Genexis-Platinum-4410-P4410-V2-1.28-Missing-Access-Control-CSRF.html
- https://www.getastra.com/blog/911/csrf-broken-access-control-in-genexis-platinum-4410/
- https://www.jinsonvarghese.com/broken-access-control-csrf-in-genexis-platinum-4410/
- http://packetstormsecurity.com/files/159936/Genexis-Platinum-4410-P4410-V2-1.28-Missing-Access-Control-CSRF.html
- https://www.getastra.com/blog/911/csrf-broken-access-control-in-genexis-platinum-4410/
- https://www.jinsonvarghese.com/broken-access-control-csrf-in-genexis-platinum-4410/