Shenzhen Zhibotong Electronics ZBT WE2001 Path Traversal Vulnerability Allowing Authentication Bypass and Administrative Access

A path traversal vulnerability has been identified in the check_token function of the Shenzhen Zhibotong Electronics ZBT WE2001 router, specifically in the 23.09.27 version. This vulnerability allows remote attackers to bypass authentication and execute administrative actions by sending a specially crafted session cookie. The issue arises from improper validation of cookie values, enabling unauthorized access to administrative functions.

Impact

Exploitation of this vulnerability allows for authentication bypass, granting attackers administrative privileges on the affected device.