Orbe ONetView Roteador Privilege Escalation Vulnerability

A privilege escalation vulnerability has been identified in the Orbe ONetView Roteador Onet-1200, specifically in the version Orbe 1680210096. This vulnerability allows remote attackers to escalate privileges by manipulating the server's response from a status code 500 to a status code 200.

Impact

Exploitation of this vulnerability could lead to unauthorized privilege escalation, allowing an attacker to gain elevated rights on the affected device.

Reproduction

To reproduce this vulnerability, access the router's menu page and click on any option, which will trigger a 500 error response. This error can be intercepted and modified using a tool like Burp Suite, changing the response status code to 200. Once the status code is altered, access to the router's configuration page is granted, enabling the execution of administrative tasks.