Sagemcom F@ST 5280 routers using firmware version 1.150.61 have insecure deserialization that allows any authenticated user to perform a privilege escalation to any other user. By making a request with valid sess_id, nonce, and ha1 values inside of the serialized session cookie, an attacker may alter the user value inside of this cookie, and assume the role and permissions of the user specified. By assuming the role of the user internal, which is inaccessible to end users by default, the attacker gains the permissions of the internal account, which includes the ability to flash custom firmware to the router, allowing the attacker to achieve a complete compromise.
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HSagemcom F\@st 5280 Router
HWSagemcomall versionsSagemcom F\@st 5280 Router Firmware
OSSagemcom1.150.61
Related vulnerabilities
Buffer overflow w usłudze ippprint routera Sagemcom F@st 3686 umożliwia RCE
Buffer overflow w Sagemcom F@ST 3686 via sessionKey przy logowaniu
Insufficient session timeout vulnerability in the FAST3686 V2 Vodafone router from Sagemcom. This vulnerabilit...
Broadcom based cable modems across multiple vendors are vulnerable to a buffer overflow, which allows a remote...
Livebox 3 Sagemcom SG30_sip-fr-5.15.8.1 devices have an insufficiently large default value for the maximum IPv...