CVE-2019-7564: coship rt3050_firmware

Vulnerability summary

CVE-2019-7564 is a critical (CVSS 9.8) vulnerability in coship rt3050_firmware. EPSS estimates a 3.05% chance of exploitation in the next 30 days, higher than 87.4% of scored vulnerabilities. 1 public exploit is recorded.

Timeline

1. 07-05-2019
   PublishedVulnerability first disclosed.
2. 04-08-2024
   Last modifiedVulnerability information updated.

Description

An issue was discovered on Shenzhen Coship WM3300 WiFi Router 5.0.0.55 devices. The password reset functionality of the Wireless SSID doesn't require any type of authentication. By making a POST request to the regx/wireless/wl_security_2G.asp URI, the attacker can change the password of the Wi-FI network.

• CWE-306Missing Authentication for Critical FunctionThe product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.