CERT-In Vulnerability Note
CIVN-2023-0150
Authentication Bypass Vulnerability in Araknis Networks Router
Original Issue Date:May 29, 2023
Severity Rating: CRITICAL
Software Affected
- Araknis Networks Router AN-310-RT-4L2W - versions prior to v.1.1.66
- Araknis Networks Router AN-110-RT-2L1W / AN-110-RT-2L1W-WIFI - versions prior to v.1.0.88
Overview
A vulnerability has been reported in Araknis Networks Routers which could allow a remote attacker to bypass authentication on the targeted device.
Description
The vulnerability exists in Araknis Networks Router due to a weak password reset mechanism at the web-based management interface. A remote attacker could exploit this vulnerability by sending specially crafted HTTP requests to the vulnerable device.
Successful exploitation of this vulnerability could allow the remote attacker to bypass authentication on the targeted device.
Credit
This vulnerability is reported by Souvik Kandar and Arko Dhar from Redinent Innovations Engineering & Research Team, Karnataka, India.
Solution
https://www.control4.com/docs/product/araknis-x10-routers/release-notes/english/latest/araknis-x10-routers-release-notes-rev-e.pdf
Vendor Information
Araknis Networks
https://www.control4.com/docs/product/araknis-x10-routers/release-notes/english/latest/araknis-x10-routers-release-notes-rev-e.pdf
References
Araknis Networks
https://www.control4.com/docs/product/araknis-x10-routers/release-notes/english/latest/araknis-x10-routers-release-notes-rev-e.pdf
CVE Name
CVE-2023-24738
Disclaimer
The information provided herein is on "as is" basis, without warranty of any kind.
Contact Information
Email: info@cert-in.org.in Phone: +91-11-24368572
Postal address
Indian Computer Emergency Response Team (CERT-In)
Ministry of Electronics and Information Technology
Government of India
Electronics Niketan
6, CGO Complex, Lodhi Road,
New Delhi - 110 003
India
|