Critical severity · published Mar 19, 2019
CVE-2019-6441
An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices
9.8
CVSS
53.6%
EPSS
No
On KEV
Description
An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current password and doesn't require any type of authentication. By making a POST request to the apply.cgi file of the router, the attacker can change the admin username and password of the router.
CVSS vector
CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
None
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)53.6% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
RF
Rt3050 Firmware · Coship
4.0.0.40 · source: NVD
RF
Rt3052 Firmware · Coship
4.0.0.48 · source: NVD
RF
Rt7620 Firmware · Coship
10.0.0.49 · source: NVD
WF
Wm3300 Firmware · Coship
5.0.0.54; 5.0.0.55 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2019-6441
CVE.org
https://www.cve.org/CVERecord?id=CVE-2019-6441
Exploit
http://packetstormsecurity.com/files/151202/Coship-Wireless-Router-Unauthenticated-Admin-Password-Reset.html
Exploit
https://packetstormsecurity.com/files/151202/Coship-Wireless-Router-Unauthenticated-Admin-Password-Reset.html
Exploit
https://vulmon.com/exploitdetails?qidtp=EDB&qid=46180
Exploit
https://www.anquanke.com/vul/id/1451446
Exploit
https://www.exploit-db.com/exploits/46180
Exploit
https://www.exploit-db.com/exploits/46180/
More from Rt3050 Firmware
9.8
CVE-2019-7564
An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices