x1tan / cve-2019-13025 Goto Github PK

There is no note of which Python packages are necessary to run the script. I needed to install requests for poc-rce.py and xmltodict for poc-information-dump.py.
Best would be to add a requirements.txt file so people can just do pip install -r requirements.txt.

Looking at your exploit, it seems to me this could be easily exploited remotely, when a user behind the router goes to an evil web page.

The page could guess the IP of the router (or infer the local address space through WebRTC) and send the Post request via Javascript fetch, or a self submitting <form>.

Makes it a bit worse than what I read elsewhere.