CVE-2019-6441
First published: Tue Mar 19 2019(Updated: )
An issue was discovered on Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 devices. The password reset functionality of the router doesn't have backend validation for the current password and doesn't require any type of authentication. By making a POST request to the apply.cgi file of the router, the attacker can change the admin username and password of the router.
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Coship Rt3050 Firmware | =4.0.0.40 | |
| Coship RT3050 | ||
| Coship Rt3052 Firmware | =4.0.0.48 | |
| Coship RT3052 | ||
| Coship Rt7620 Firmware | =10.0.0.49 | |
| Coship Rt7620 | ||
| Coship Wm3300 Firmware | =5.0.0.54 | |
| Coship Wm3300 Firmware | =5.0.0.55 | |
| Coship WM3300 | ||
| All of | ||
| Coship Rt3050 Firmware | =4.0.0.40 | |
| Coship RT3050 | ||
| All of | ||
| Coship Rt3052 Firmware | =4.0.0.48 | |
| Coship RT3052 | ||
| All of | ||
| Coship Rt7620 Firmware | =10.0.0.49 | |
| Coship Rt7620 | ||
| All of | ||
| Any of | ||
| Coship Wm3300 Firmware | =5.0.0.54 | |
| Coship Wm3300 Firmware | =5.0.0.55 | |
| Coship WM3300 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://packetstormsecurity.com/files/151202/Coship-Wireless-Router-Unauthenticated-Admin-Password-Reset.html
- https://packetstormsecurity.com/files/151202/Coship-Wireless-Router-Unauthenticated-Admin-Password-Reset.html
- https://vulmon.com/exploitdetails?qidtp=EDB&qid=46180
- https://www.anquanke.com/vul/id/1451446
- https://www.exploit-db.com/exploits/46180
- https://www.exploit-db.com/exploits/46180/
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2019-6441.
What is the severity of CVE-2019-6441?
The severity of CVE-2019-6441 is critical with a score of 9.8.
Which devices are affected by CVE-2019-6441?
Shenzhen Coship RT3050 4.0.0.40, RT3052 4.0.0.48, RT7620 10.0.0.49, WM3300 5.0.0.54, and WM3300 5.0.0.55 are affected by this vulnerability.
What is the impact of CVE-2019-6441?
This vulnerability allows an attacker to reset the router's password without any authentication, potentially granting access to the admin interface and control over the router.
Is there a fix available for CVE-2019-6441?
At the moment, there is no fix available for CVE-2019-6441. It is recommended to update to the latest firmware version provided by the vendor when it becomes available.
- collector/nvd-index
- agent/type
- agent/references
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/weakness
- agent/description
- agent/first-publish-date
- collector/nvd-api
- source/NVD
- agent/software-canonical-lookup
- agent/author
- agent/last-modified-date
- agent/softwarecombine
- agent/tags
- agent/event
- vendor/coship
- canonical/coship rt3050 firmware
- version/coship rt3050 firmware/4.0.0.40
- canonical/coship rt3050
- canonical/coship rt3052 firmware
- version/coship rt3052 firmware/4.0.0.48
- canonical/coship rt3052
- canonical/coship rt7620 firmware
- version/coship rt7620 firmware/10.0.0.49
- canonical/coship rt7620
- canonical/coship wm3300 firmware
- version/coship wm3300 firmware/5.0.0.54
- version/coship wm3300 firmware/5.0.0.55
- canonical/coship wm3300