• Wireless Security Configuration Page (2.4GHz & 5GHz)
• WPA/WAPI Passphrase Field
• Status Page (<a href="javascript:pin_window()">...</a>)

Attack Vectors

Steps to Reproduce

1. Login to the Router Web Interface

   • Open a web browser and navigate to the router's admin panel (e.g., http://192.168.100.1).
   • Enter valid admin credentials.

2. Inject the Malicious XSS Payload in Both Wireless Bands

   • For 2.4GHz Band (wl0):
     1. Navigate to Wireless > Security under 2.4GHz (wl0).
     2. Locate the WPA/WAPI Passphrase field.
     3. Inject the following XSS payload into the passphrase field:
        root@kitploit:~

        </center><script>alert("XSS Triggered")</script>
        

     4. Click Apply/Save to store the malicious payload.
   • For 5GHz Band (wl1):
     1. Repeat the same steps as above in 5GHz (wl1) Security Settings.

3. Trigger the XSS Execution

   • For 2.4GHz Band (wl0):
     1. Navigate to Status from the navigation menu.
     2. Click 2.4GHz (wl0).
     3. Click "Click here to display" next to the Password field.
     4. The XSS payload executes inside the pop-up.
   • For 5GHz Band (wl1):
     1. Perform the same steps in Status > 5GHz (wl1) to trigger the XSS.

Discoverer

• Name: Asim Barnawi

References

• DZS Official Website
• ZNID-GPON-2428B1-0ST Product Page

Mitigation

• Vendor Action: The vendor should sanitize user input in the WPA/WAPI Passphrase field to prevent the execution of malicious scripts.

Disclaimer: This repository is for informational purposes only. The discoverer and publisher of this information are not responsible for any misuse of the disclosed vulnerability.