Other nomination

Misfortune Cookie -- TR-069 ACS Vulnerabilities in residential gateway routers

Check Point Software Technologies and @jifa · Misfortune Cookie Vulnerability by Check Point

CVE-2014-9222 in the AllegroSoft RomPager embedded web server: a crafted HTTP cookie corrupts memory in the cookie handling code and makes the device treat the current session as administrative. One packet to a public IP takes over the gateway, and Check Point counted about 12 million exploitable residential routers across 200 device models and 189 countries.

Record

Researcher

Check Point Software Technologies and @jifa

Published by

Misfortune Cookie Vulnerability by Check Point

In the archive

• Nominated for the 2014 Top 10 Web Hacking Techniques

Related sources

• Protection whitepaper

Tags

• cookie
• auth-bypass
• privilege-escalation
• http
• cve
• large-scale-scan
• vendor-advisory
• owasp-a01-2021
• owasp-a07-2021

This page is the archive's own catalogue record. The research is the work of Check Point Software Technologies and @jifa, first published at the original source. Preserved copies are kept so the citation survives its host.