Edimax EW-7438RPn Mini Wi-Fi Extender Unauthenticated Wi-Fi Password Disclosure Vulnerability

A vulnerability in the Edimax EW-7438RPn Mini Wi-Fi range extender, specifically in version 1.27, allows unauthenticated attackers to access the /wizard_reboot.asp page in 'unsetup' mode. This access discloses the Wi-Fi SSID and security key. Attackers can retrieve the wireless password by sending a GET request to this endpoint, exposing sensitive information without authentication.

Impact

Exploitation of this vulnerability leads to unauthorized disclosure of the Wi-Fi password, allowing attackers to gain access to the wireless network.

Reproduction

The vulnerability can be reproduced by sending a GET request to the /wizard_reboot.asp page while the device is in 'unsetup' mode'. This can be done without any authentication, directly accessing the page to retrieve the Wi-Fi SSID and security key.