CVE-2021-27825
📋 TL;DR
This directory traversal vulnerability in Mercury MAC1200R routers allows attackers to read arbitrary files on the device by manipulating web-static/ URLs. Attackers can access sensitive configuration files, credentials, or system information without authentication. Only users of Mercury MAC1200R routers are affected.
💻 Affected Systems
- Mercury MAC1200R
📦 What is this software?
Mac1200r Firmware by Mercurycom
⚠️ Risk & Real-World Impact
Worst Case
Attackers gain administrative credentials, compromise the router completely, pivot to internal networks, and maintain persistent access.
Likely Case
Attackers extract configuration files containing admin passwords, Wi-Fi credentials, and network settings to hijack the router.
If Mitigated
With proper network segmentation and access controls, impact is limited to the router itself without lateral movement.
🎯 Exploit Status
Simple HTTP request manipulation required. Public exploit code available in Packet Storm references.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: Unknown
Vendor Advisory: https://www.mercurycom.com.cn/product-1-1.html
Restart Required: Yes
Instructions:
1. Check vendor website for firmware updates. 2. Download latest firmware. 3. Access router admin interface. 4. Upload and apply firmware update. 5. Reboot router.
🔧 Temporary Workarounds
Disable WAN access to web interface
allPrevent external exploitation by disabling remote administration
Access router admin panel → Security → Remote Management → Disable
Network segmentation
allIsolate router management interface to separate VLAN
🧯 If You Can't Patch
- Replace affected devices with supported models
- Implement strict firewall rules blocking all external access to router web interface
🔍 How to Verify
Check if Vulnerable:
Attempt to access http://[router-ip]/web-static/../../../etc/passwd or similar traversal pathsCheck Version:
Check router web interface → System Status → Firmware VersionVerify Fix Applied:
Test same traversal attempts after patching - should return 404 or access denied📡 Detection & Monitoring
Log Indicators:
- HTTP requests containing 'web-static/' with '../' sequences
- Access to sensitive system files from web interface
Network Indicators:
- Unusual HTTP requests to router IP with directory traversal patterns
- Multiple failed access attempts to admin paths
SIEM Query:
http.url:*web-static* AND http.url:*..%2F*