Top 10 winner

Residential Gateway "Misfortune Cookie"

@mike_mimoso · Threatpost | The first stop for security news · 18 December 2014

More than 12 million home routers and residential gateways run the RomPager embedded webserver, where a single crafted HTTP cookie corrupts memory and hands an attacker remote administrative control from the internet side. Check Point named it Misfortune Cookie; the 2002 code was fixed in 2005 but still shipped in 2014 firmware.

Record

Researcher

@mike_mimoso

Published by

Threatpost | The first stop for security news

Date

18 December 2014

In the archive

• Ranked #5 in the 2014 Top 10 Web Hacking Techniques

Tags

• cookie
• rce
• http
• auth-bypass
• supply-chain
• large-scale-scan
• vendor-advisory
• owasp-a01-2021
• owasp-a06-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of @mike_mimoso, first published at the original source. Preserved copies are kept so the citation survives its host.