CVE-2015-5995
📋 TL;DR
This vulnerability allows remote attackers to bypass authentication on Mediabridge Medialink MWN-WAPR300N and Tenda N3 Wireless N150 routers by including 'admin' in an HTTP Cookie header. Attackers can gain administrative access without credentials. Users of these specific router models with vulnerable firmware are affected.
💻 Affected Systems
- Mediabridge Medialink MWN-WAPR300N
- Tenda N3 Wireless N150
📦 What is this software?
Medialink Mwn Wapr300n Firmware by Mediabridge
⚠️ Risk & Real-World Impact
Worst Case
Complete compromise of router configuration, network traffic interception, malware deployment, and use as attack platform
Likely Case
Unauthorized configuration changes, DNS hijacking, credential theft from connected devices
If Mitigated
Limited impact if routers are behind firewalls or not internet-facing
🎯 Exploit Status
Simple HTTP request manipulation required, no special tools needed
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown specific version - check vendor for firmware updates
Vendor Advisory: https://www.kb.cert.org/vuls/id/630872
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates 2. Download latest firmware 3. Access router admin interface 4. Upload and apply firmware update 5. Reboot router
🔧 Temporary Workarounds
Disable remote administration
allPrevent external access to router web interface
Change default IP range
allMove router to non-standard subnet to reduce scan exposure
🧯 If You Can't Patch
- Replace affected routers with supported models
- Place routers behind firewall with strict inbound rules
🔍 How to Verify
Check if Vulnerable:
Attempt to access router admin page with 'Cookie: admin' header using curl or browser extensionCheck Version:
Check router web interface status page or use manufacturer-specific CLI commandsVerify Fix Applied:
Test authentication bypass no longer works after firmware update📡 Detection & Monitoring
Log Indicators:
- HTTP requests with 'admin' in Cookie header to router admin pages
- Multiple failed login attempts followed by successful access
Network Indicators:
- Unusual admin interface access from external IPs
- Configuration changes from unauthorized sources
SIEM Query:
http.cookie contains "admin" AND dst_ip in [router_ips]