Beetel 450TC3 Router Auth Privilege Escalation Analysis

Summary of Key Vulnerability Information Vulnerability Overview Vulnerability Name: Authenticated Privilege Escalation Vulnerability in the Beetel 450TC3 Router CWE: CWE-269 – Improper Privilege Management Vulnerability Type: Authenticated Privilege Escalation Cause: The password modification feature on the router’s web management interface suffers from an authorization flaw. A low-privilege authenticated user can intercept and modify their own password change request by replacing the username with the administrator (root) username and removing the old password parameter. The server accepts the request and updates the administrator’s password without validating the target account’s current password. Scope of Impact Affected Product: Beetel 450TC3 Router Affected Firmware Version: V01.00.00_01 Impact: An attacker (low-privilege user) can reset the administrator password, thereby enabling them to: - Reset the administrator password - Gain full administrative privileges - Modify router configurations - Change firewall and DNS settings - Create, modify, or delete user accounts - Achieve full control over the affected device Reproduction Steps (Key Actions) 1. Log in to the router’s web management interface using a low-privilege user account. 2. Navigate to the User Management page, select their own user account, and choose the Modify Password option. 3. Enter the new password and the current (old) password, but do not submit yet. 4. Use a web proxy (e.g., Burp Suite) to intercept the HTTP request. 5. Modify the intercepted request: - Replace the authenticated user’s username with the administrator (root) username - Remove the old_password parameter from the request 6. Forward the modified request to the server. 7. The server accepts the request and updates the administrator password without verifying: - Whether the authenticated user is authorized to modify the administrator account - The administrator account’s current password 8. Log out of the low-privilege user account. 9. Log in using the administrator (root) username and the new password. Expected Result vs. Actual Result Expected: The server should reject the request (as a low-privilege user lacks permission to modify another user’s password) and should require and validate the target account’s current password. Actual: The server accepts the modified request and changes the administrator password, allowing the low-privilege user to log in as administrator and gain full administrative privileges. Remediation The page does not provide an official fix patch. However, based on the root cause, the direction for the fix is as follows: 1. Add authorization validation to the password modification endpoint: verify that the target username in the request belongs to the currently authenticated user (preventing unauthorized modifications to other accounts). 2. Require and validate the target account’s current (old) password; reject the request if it is missing or incorrect. 3. Add CSRF/signature validation to password modification requests to prevent modified requests from taking effect directly after being tampered with. POC / Exploit Code The page does not include POC code or exploit code blocks; it only illustrates the request interception and modification process using Burp Suite via screenshots (no text code blocks). Discoverer Discovered and reported by: Greejth K.

Goal Reached Thanks to every supporter — we hit 100%!

Beetel 450TC3 Router Auth Privilege Escalation Analysis

More from this source