CVE-2013-0126
Verizon FIOS Actiontec MI424WR-GEN3I Router Firmware 40.19.36 - Cross-Site Request Forgery via index.cgi
Title source: llmExploitation Summary
EIP tracks 1 public exploit for CVE-2013-0126. PoCs published by Jacob Holcomb.
AI-analyzed exploit summary This exploit demonstrates a CSRF vulnerability in Verizon FIOS routers, allowing an attacker to add an administrator user and enable remote administration without user interaction. The exploit consists of three HTML files that chain CSRF requests to achieve the attack.
Description
Multiple cross-site request forgery (CSRF) vulnerabilities in index.cgi on the Verizon FIOS Actiontec MI424WR-GEN3I router with firmware 40.19.36 allow remote attackers to hijack the authentication of administrators for requests that (1) add administrative accounts via the username and user_level parameters or (2) enable remote administration via the is_telnet_primary and is_telnet_secondary parameters.
Exploits (1)
This exploit demonstrates a CSRF vulnerability in Verizon FIOS routers, allowing an attacker to add an administrator user and enable remote administration without user interaction. The exploit consists of three HTML files that chain CSRF requests to achieve the attack.