关键信息 漏洞标题: NuCom 11N Wireless Router 5.07.90 Privilege Escalation via Configuration Backup 严重性: High 日期: December 31, 2025 受影响的版本: - 5.07.90_multi_NCM01 - 5.07.89_multi_NCM01 - 5.07.88_multi_SVPKI - 5.07.84_multi_NCM01 - 5.07.81_multi_NCM01 - 5.07.80_multi_SVPKI - 5.07.76_multi_NCM01 - 5.07.74_multi_NCM01 - 5.07.72_multi_NCM01 CVE: CVE-2021-47726 CWE: CWE-522 Insufficiently Protected Credentials CVSS v4 Vector: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/VSC:N/SCI:N/SIT:N/SAM:N 参考资料: - ExploitDB-49634 - NuCom Vendor Homepage - Zero Science Lab Disclosure (ZSL-2021-5629) 发现者: LiquidWorm as Gjoko Krstic of Zero Science Lab 描述: NuCom 11N Wireless Router 5.07.90 存在权限提升漏洞，允许非特权用户通过配置备份端点访问管理凭据。攻击者可以通过向备份配置页面发送带有特定cookie的HTTP GET请求来检索和解码admin密码(Base64格式)。