Securin Zero-Days

We created a forged request by changing the value of any variable. In InternetGatewayDevice.X_TWSZ-COM_URL_Filter.BlackList.1 variable in the URL http://router-ip/cgi-bin/webproc was sent to the victim by forcing him/her to click on the malicious link generated by an attacker. With different sessions, it allows the attacker to change the settings of the victim’s router.

Figure 01: Blocked site keywords before the CSRF request was sent to the victim.

 
Figure 02: CSRF Request is created by changing the Blocklist URL variable.

Figure 03: CSRF request is successfully submitted in the victim’s browser.

Note: Similarly, we can manipulate any request and can force the victim to access the link generated by the attacker to make changes to the router settings without the victim’s knowledge.