Carrier Vitogate 300 Web Interface Authentication Bypass Vulnerability

An authentication bypass vulnerability has been identified in the Carrier Vitogate 300 web interface. The issue arises because the interface does not properly enforce server-side authentication, instead relying on frontend authentication controls. This flaw allows attackers to manipulate HTML elements using the browser's developer tools to bypass login restrictions. By removing certain UI elements, an attacker can access the hidden administration menu and gain full control over the device.

Impact

Exploitation of this vulnerability allows unauthorized access to the administration menu, granting full control over the affected device.