CVE-2020-37150
📋 TL;DR
This vulnerability allows unauthenticated attackers to access the /wizard_reboot.asp page on Edimax EW-7438RPn-v3 Mini range extenders, which discloses the Wi-Fi SSID and security key. Attackers can retrieve wireless passwords via simple GET requests without any authentication. This affects users of Edimax EW-7438RPn-v3 Mini range extenders running firmware version 1.27.
💻 Affected Systems
- Edimax EW-7438RPn-v3 Mini
📦 What is this software?
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain unauthorized access to the wireless network, potentially compromising all connected devices, intercepting network traffic, and launching further attacks against internal systems.
Likely Case
Local attackers within wireless range obtain the Wi-Fi password and join the network without authorization, potentially accessing shared resources and monitoring network traffic.
If Mitigated
With proper network segmentation and monitoring, impact is limited to the wireless network perimeter with no access to critical internal systems.
🎯 Exploit Status
Simple HTTP GET request to /wizard_reboot.asp endpoint. Exploit code is publicly available on Exploit-DB.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.edimax.com/edimax/merchandise/merchandise_detail/data/edimax/global/wi-fi_range_extenders_n300/ew-7438rpn_mini/
Restart Required: No
Instructions:
1. Check Edimax website for firmware updates. 2. Download latest firmware. 3. Access device web interface. 4. Navigate to firmware update section. 5. Upload and apply new firmware.
🔧 Temporary Workarounds
Disable Unsetup Mode
allComplete device setup wizard to exit unsetup mode where vulnerability exists
Network Isolation
allPlace affected range extender on isolated network segment with strict firewall rules
🧯 If You Can't Patch
- Physically secure device to prevent unauthorized physical/wireless access
- Replace with different vendor/model that receives security updates
🔍 How to Verify
Check if Vulnerable:
Send HTTP GET request to http://[device-ip]/wizard_reboot.asp and check if Wi-Fi credentials are returned in responseCheck Version:
Check web interface status page or use nmap -sV -p80 [device-ip] to identify firmware versionVerify Fix Applied:
Attempt same GET request after remediation - should return error or no sensitive data📡 Detection & Monitoring
Log Indicators:
- HTTP GET requests to /wizard_reboot.asp from unauthorized IPs
- Multiple failed authentication attempts followed by successful access to wizard pages
Network Indicators:
- Unusual HTTP traffic to device management interface from unexpected sources
- ARP spoofing or unusual MAC addresses on wireless network
SIEM Query:
source_ip=* AND url_path="/wizard_reboot.asp" AND http_method="GET" AND NOT user_agent="*Edimax*"