CVE-2019-7564 Missing authorization in n/a
Unauthenticated attackers can change the WiFi password on Coship WM3300 routers by sending a specific POST request, bypassing authentication controls.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2019-7564?
CVE-2019-7564 is a critical missing authorization vulnerability in n/a, published on 7 May 2019. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type of authentication. By making a POST request to the regx/wireless/wl_security_2G.asp URI, the attacker can change the password of the Wi-FI network.
Weakness: CWE-306
Which versions are affected by CVE-2019-7564?
It affects 4 products.
Products include Coship Rt3050 Firmware, Coship Rt3052 Firmware, Coship Rt7620 Firmware, Coship Wm3300 Firmware.
How do I fix CVE-2019-7564?
No fix has been published for CVE-2019-7564 yet. Limit exposure of the affected software until one is available.
Upgrade, and check permissions on every request on the server, not only in the interface. More about Missing authorization.
Is CVE-2019-7564 being exploited?
There is no known exploitation of CVE-2019-7564 in the wild and no public exploit code.
Other vulnerabilities in n/a
Sources
Also known as GHSA-7g2v-29mr-2f42.