=====[Tempest Security Intelligence]========================================== Multiple vulnerabilities in the web management interface of Intelbras routers Author: Gabriel Lima =====[Table of Contents]====================================================== 1. Overview 2. Detailed description 3. Other contexts & solutions 4. Acknowledgements 5. Timeline 6. References =====[1. Overview]============================================================ * Systems affected: Intelbras web interface RX 1500 - 2.2.9 (verified) (other routers/versions may be affected) Intelbras web interface RX 3000 - 1.0.11 (verified) (other routers/versions may be affected) * Release date: 07/14/2025 * Impact: Several vulnerabilities were found providing retrieval of administrative session tokens and direct unauthenticated access to sensitive features that allow the recovery of current router configuration. The new generation of connection comes via Wi-Fi 6 technology, delivering more speed, more network efficiency and less interference. Router RX 1500 [1] and RX 3000 [2] are ideal for residential plans with high-speed plans and high-performance connections. =====[2. Detailed description]================================================ The web management system for the RX 1500 and 3000 routers is designed to help the device’s administrator configure the device in the best way for their needs. However, upon carrying out a security research, multiple vulnerabilities related to XSS and direct unauthenticated access were spotted. As a result of performing this research, two types of vulnerabilities were found: Cross-Site Scripting (XSS) vulnerabilities and Direct Unauthenticated Access vulnerabilities. In regard to the XSS vulnerabilities, as a means to portray impact outcomes, an unauthenticated attacker may gain administrative access to the system and have full control of the router. On the other hand, an attacker with administrator access is able to create persistence to maintain access. Furthermore, in regard to the direct and unauthenticated access vulnerabilities, the application hosts endpoints that provide the retrieval of log files and the router's configuration file, which in turn, stores the device's password and its current settings. An important highlight regards the fact that any feature can be accessed in an unauthenticated manner, as long as an administrator is authenticated and active within the system. The following section dissects the XSS issues. 2.1 Possibility of injecting JavaScript code into client names (XSS) - CVE-2025-26064 An authenticated threat may inject persistent JavaScript from the connected clients configuration feature (Home > Connected clients). This problem occurs due to the lack of character handling in the “Name” field. As proof of concept, the following payload was used: <script>alert(1)</script> Payload used in plain text: The following request pinpoints the insertion of the payload: [snippet] POST /HNAP1/ HTTP/1.1 Host: 10.0.0.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://purenetworks.com/HNAP1/SetClientInfo" X-Requested-With: XMLHttpRequest Content-Length: 596 Cookie: uid=COOKIE-HERE Client-MacAddresssPAYLOAD-IN-HTML-ENCODEWIFI_5Gchange [/snippet] Upon submitting this request, please note the outcome rendered within the context of the victim's browser. 2.2 Possibility of injecting JavaScript code into the name of the visiting network (XSS) - CVE-2025-26064 An authenticated threat may inject persistent JavaScript from the Guest Network functionality (in the Settings > Wi-Fi > Guest Network menu). This problem occurs due to the lack of character handling in the “Wi-Fi network name” field (both in 2.4GHz and 5GHz). As a proof of concept, the following payloads were HTML encoded and inserted into each field: 2.4GHz network: <script>alert(1)</script> 5GHz network: <script>alert(2)</script> Payloads used in plain text: 2.4GHz network: 5GHz network: The following portrays an example of the request submitted by the attacker: [snippet] POST /HNAP1/ HTTP/1.1 Host: 10.0.0.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://purenetworks.com/HNAP1/SetMultipleActions" X-Requested-With: XMLHttpRequest Content-Length: 2991 Cookie: uid=COOKIE-HERE RADIO_2.4GHz_Guestfalsetrue802.11bgnPAYLOAD-IN-HTML-ENCODE-2.4GHztrue20/4000falseAlwaysfalseRADIO_2.4GHz_GuestfalseOPENNONEROUTER-KEYRADIO_5GHz_Guestfalsetrue802.11anacPAYLOAD-IN-HTML-ENCODE-5GHztrue20/40/8000falsefalseRADIO_5GHz_GuestfalseOPENNONEROUTER-KEYfalsetrue0 [/snippet] By accessing the system's home page (namely: the Status page), one can observe the JavaScript rendering for both fields. 2.3 Possibility of multiple JavaScript code injections in the Site Survey feature (XSS) - CVE-2025-26063 The “Site Survey” feature (Management > Site Survey) has the purpose of displaying nearby active WIFI networks, and presenting their ESSIDs among other details. However, due to the lack of character handling, whenever an attacker creates a fake WIFI network containing HTML/JavaScript code (e.g. “”), and the router administrator uses this feature, the malicious code will be executed at the moment the tab listing all available ESSIDs is opened. As a proof of concept, an SSID with the following name was created: The following portrays an example of the request made by the administrator upon starting “Site Survey” scan: [snippet] POST /HNAP1/ HTTP/1.1 Host: [redacted] SOAPAction: "http://purenetworks.com/HNAP1/igd_wifi_list_scan_start" X-Requested-With: XMLHttpRequest Content-Length: 357 Cookie: [redacted] 2.4g [/snippet] The XSS is executed by hovering the mouse pointer over the network's name (highlighted in the graphic presented within the router’s/device’s web management interface) or by opening the nearby devices section. The following section dissects the direct unauthenticated access issues. 2.4 Incorrect Access Control - CVE-2025-26062 This session will address 3 access control breach vulnerabilities, considered by mitre to be duplicates. For better understanding, they will be considered only as one topic. 2.4.1 Possibility of retrieving router logs The given router's administrative interface provides a feature (Management > System log) that allows an authenticated entity (e.g: an administrator) to retrieve the router's log file, which may contain potentially sensitive debug information. However, due to the lack of permissions validation, an unauthenticated entity can download the file without performing the authentication procedure. The following is an example request used as proof of concept: [snippet] POST /cgi-bin/dllog.cgi HTTP/1.1 Host: 10.0.0.1 Content-Type: application/x-www-form-urlencoded Content-Length: 13 Export=Export [/snippet] As a result, a log file containing potentially sensitive information is provided for download. 2.4.2 Possibility of recovering backups of router settings The given router's administrative interface provides a feature (Management > System) that allows an authenticated entity (e.g: an administrator) to retrieve the router's current configuration file, which may contain potentially sensitive information pertaining to the environment. However, due to the lack of permissions validation, an unauthenticated entity can download the file without performing the authentication procedure. To exploit the aforementioned concept, the following snippet illustrates the request made at the affected point by an unauthenticated attacker retrieving the router's configuration file, as well as showing part of the contents of the ".cfg" file in the request response: [snippet] POST /cgi-bin/ExportSettings.sh HTTP/1.1 Host: 10.0.0.1 Content-Type: application/x-www-form-urlencoded Content-Length: 13 Export=Export [/snippet] As a result of submitting the previously shown request, the retrieval of the .cfg backup file is done without the need for providing proper authorization. 2.4.3 Possibility of accessing various functionalities in an unauthenticated manner Various router features, such as editing firewall rules, configuring Wi-Fi specifications, and changing router security rules and policies, were found to be accessible in an unauthenticated manner if an administrator synchronically accessed the router's administrative interface at the moment of exploitation. In other words, the only caveat necessary to exploit this unauthenticated access is having an administrator logged in at the moment of exploitation. The following snippet represents a request to render the router's administrative interface publicly accessible (e.g.: accessible from the Internet): [snippet] POST /HNAP1/ HTTP/1.1 Host: 10.0.0.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://purenetworks.com/HNAP1/SetAdministrationSettings" X-Requested-With: XMLHttpRequest Content-Length: 491 falsetrue8080false [/snippet] The following snippet portrays a request with the purpose of disabling the router's Denial of Service (DoS) protection: [snippet] POST /HNAP1/ HTTP/1.1 Host: 10.0.0.1 Content-Type: text/xml; charset=utf-8 SOAPAction: "http://purenetworks.com/HNAP1/SetFirewallEnableSettings" X-Requested-With: XMLHttpRequest Content-Length: 381 false [/snippet] Other features are accessible in an unauthenticated manner, as long as the request is sent when the administrator is active. According to the arguments disclosed in this section, various attack vectors for administrative access originating from the perspective of an unauthenticated user becomes feasible. Furthermore, once authenticated as an administrator, an attacker would be able to generate persistence with the same approaches. =====[3. Other contexts & solutions]========================================== In regard to the XSS disclosed issues, it is recommended that all information coming from third parties (databases, other applications, client-side, etc.) have their special characters converted to the **HTML Entities** character set. Moreover, the data must be semantically filtered to guarantee that it conforms to the expected format and is free of any undesired characters. In regard to the unauthenticated access disclosed issues, it is strongly recommended that changes be made to the application's existing session management and access control, such that access to sensitive functionalities is available only to authenticated users, and that these users perform only actions permitted by their authorization profile. Moreover, it is important to highlight that all logic that determines whether a user has the necessary permissions to perform a certain action must execute **exclusively on the server-side**. =====[4. Acknowledgements]==================================================== - Joaquim Brasil de Oliveira < joaquim brasil () tempest com br > - Tempest Security Intelligence[3] =====[5. Timeline]============================================================ 07/15/2024 - We contacted the manufacturer reporting an XSS vulnerability in the Site Survey functionality; 07/16/2024 - The vendor requested contact information; 07/17/2024 - Contact information has been sent to the supplier; 07/17/2024 - The vendor has begun the process of validating and acknowledging the first bug reported; 07/22/2024 - A full report has been sent with all the other discovered vulnerabilities; 07/25/2024 - The vendor acknowledged all the vulnerabilities reported in the RX 1500 and RX 3000 devices; 09/19/2024 - The vendor has released the beta version of the corrected firmware 2.2.12 09/23/2024 - All points have been retested and fixed; 01/27/2025 - Request CVE IDs from MITRE; 02/24/2025 - MITRE sent the CVEs IDs; 07/14/2025 - Publication date. =====[6. References]========================================================== [1] https://www.intelbras.com/pt-br/roteador-wi-fi-6-dual-band-rx-1500 [2] http://intelbras.com/pt-br/roteador-wireless-rx-3000 [3] https://tempest.com.br -- *Esta mensagem é para uso exclusivo de seu destinatário e pode conter informações privilegiadas e confidenciais. Todas as informações aqui contidas devem ser tratadas como confidenciais e não devem ser divulgadas a terceiros sem o prévio consentimento por escrito da Tempest. Se você não é o destinatário não deve distribuir, copiar ou arquivar a mensagem. Neste caso, por favor, notifique o remetente da mesma e destrua imediatamente a mensagem.* * * *This message is intended solely for the use of its addressee and may contain privileged or confidential information. All information contained herein shall be treated as confidential and shall not be disclosed to any third party without Tempest’s prior written approval. If you are not the addressee you should not distribute, copy or file this message. In this case, please notify the sender and destroy its contents immediately.** * * *