CVE-2015-2797
AirTies Air Firmware < 1.0.2.0 - Remote Code Execution via Long Redirect Parameter
Title source: llmExploitation Summary
EIP tracks 4 public exploits for CVE-2015-2797.
PoCs published by Metasploit, Batuhan Burakcin, Bariskizilkaya, including Metasploit module exploits/linux/http/airties_login_cgi_bof.
AI-analyzed exploit summary This Metasploit module exploits a buffer overflow vulnerability in Airties routers via a maliciously crafted HTTP POST request to the login CGI with an overly long redirect parameter. It achieves remote code execution by leveraging a cmdstager to deliver a payload, targeting MIPS big-endian architectures.
Description
Stack-based buffer overflow in AirTies Air 6372, 5760, 5750, 5650TT, 5453, 5444TT, 5443, 5442, 5343, 5342, 5341, and 5021 DSL modems with firmware 1.0.2.0 and earlier allows remote attackers to execute arbitrary code via a long string in the redirect parameter to cgi-bin/login.
Exploits (4)
This Metasploit module exploits a buffer overflow vulnerability in Airties routers via a maliciously crafted HTTP POST request to the login CGI with an overly long redirect parameter. It achieves remote code execution by leveraging a cmdstager to deliver a payload, targeting MIPS big-endian architectures.
This exploit targets a buffer overflow vulnerability in AIRTIES Air5650v3TT routers, delivering a reverse shell payload. It constructs a malicious HTTP request with shellcode to achieve remote code execution.
This PoC exploits a buffer overflow vulnerability in the AirTies 5650 router's login CGI by sending an excessively long redirect parameter, leading to a crash or potential code execution. The script uses chroot and qemu-mips-static to emulate the environment for testing.
This Metasploit module exploits a buffer overflow vulnerability in Airties routers via a maliciously crafted HTTP POST request to the login CGI with an overly long redirect parameter. It achieves remote code execution by overwriting the return address and leveraging ROP gadgets to call system().