""ET EXPLOIT AsusWRT RT-AC750GF Cross-Site Request Forgery""

SID: 2025736

Revision: 3

Class Type: web-application-attack

Metadata: attack_target Networking_Equipment, created_at 2018_06_25, deployment Perimeter, signature_severity Major, updated_at 2022_05_03

Reference:

Protocol: tcp

Source Network: $EXTERNAL_NET

Source Port: $HTTP_PORTS

Destination Network: $HOME_NET

Destination Port: any

Flow: established,to_client

Contents:

  • Value: "

    "

  • Value: "name=|22|action_mode|22 20|value=|22|refresh_networkmap|22|"

  • Value: "start_apply.htm?productid="

  • Value: "&current_page=Advanced_System_Content.asp"

  • Value: "&next_page=Advanced_System_Content.asp"

  • Value: "&action_mode=apply"

  • Value: "&http_username="

  • Value: "&http_passwd="

  • Value: "&sshd_enable="

Within:

PCRE:

Special Options:

  • file_data

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

  • nocase

source