Shenzhen Zhibotong Electronics ZBT WE2001 Missing Authentication Vulnerability in Web Management API

A vulnerability exists in the web management API of the Shenzhen Zhibotong Electronics ZBT WE2001 router, specifically in version 23.09.27. The issue arises from a missing authentication mechanism, allowing unauthenticated attackers on the local network to alter router and network settings. Exploitation involves invoking specific operations that end with '*_nocommit' and providing the required parameters, enabling attackers to change various configuration details such as the SSID, Wi-Fi passwords, and administrative credentials, all without the need for authentication or an active session.

Impact

Exploitation of this vulnerability could lead to unauthorized modifications of router settings and network configurations, including changes to Wi-Fi credentials and administrative passwords.