eWON Authentication Bypass Vulnerability in Firmware Versions 12.2 through 13.0

An authentication bypass vulnerability has been identified in eWON firmware versions 12.2 to 13.0. This vulnerability allows attackers with minimal privileges to access sensitive user data by exploiting the wsdReadForm endpoint. By sending POST requests to wrcgi.bin/wsdReadForm with base64-encoded partial credentials and a crafted wsdList parameter, attackers can extract encrypted passwords for all users. These passwords can then be decrypted using a hardcoded XOR key.

Impact

Exploitation of this vulnerability allows for unauthorized access to sensitive user data, specifically encrypted passwords, which can be decrypted and retrieved in clear text.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /wrcgi.bin/wsdReadForm endpoint. The request must include base64-encoded partial credentials and a crafted wsdList parameter that requests password information for all users. The extracted encrypted passwords can then be decrypted using the hardcoded XOR key.

Remediation

Users are advised to update to eWON firmware version 13.3 or later, where this vulnerability has been addressed.