published March 19, 2019
NVD has not assigned a CVSS score to this record. It sits in the 99.0th percentile for exploit probability.
🚨 A simple POST request is all it takes to take over admin rights on multiple Coship router models! 🔥 Think of it as a phone with a broken lock mechanism — anyone can change the contact details without needing to verify their identity. That's exactly what's happening here with the password reset feature! An attacker could stroll right into your router settings, changing the admin username and password at will. This means they could potentially hijack your network, snoop on your traffic, or even launch attacks from your IP. Very unsettling indeed!
Think of it as a phone with a broken lock mechanism — anyone can change the contact details without needing to verify their identity. That's exactly what's happening here with the password reset feature! This vulnerability stems from a lack of backend validation in the password reset functionality of Coship RT3050, RT3052, and WM3300 devices, allowing unauthorized users to alter admin credentials without any authentication.
An attacker could stroll right into your router settings, changing the admin username and password at will. This means they could potentially hijack your network, snoop on your traffic, or even launch attacks from your IP. Very unsettling indeed! To remediate this, ensure your devices are updated with the latest firmware versions available. If possible, disable WAN access to the router's admin interface, and consider using a strong, unique password for your router. Regularly check for firmware updates to stay protected. You can tackle this! Follow these steps to secure your device and keep your network safe. 🛡️