Description
Hidden functionality in the /goform/setSysTools endpoint in Nexxt Solutions Nebula 300+ firmware through version 12.01.01.37 allows remote enablement of a Telnet service. By sending a crafted POST request with parameters such as telnetManageEn=true and telnetPwd, an authenticated attacker can activate a Telnet service on port 23. This exposes a privileged diagnostic interface that is not intended for external access and can be used to interact with the underlying system.
Problem types
Product status
<= 12.01.01.37 (custom)
Credits
Angel Barre (call4pwn)
References
www.nexxtsolutions.com/...vity/internal-products/ARN02304U6/ (Official product page)
nexxt-connectivity-frontend.s3.amazonaws.com/...01.01.37.zip (Firmware download)