Affected Product

• Device: FD602GW-DX-R410 Fiber Router
• Firmware Version: V2.2.14 (Build.1918.241111)
• Web Server: Boa/0.93.15

Vulnerability Details

• Type: Reflected Cross-Site Scripting (XSS)
• Attack Vector: Remote (authenticated user required)
• Impact:
  • Arbitrary JavaScript execution with admin privileges
  • Potential session hijacking, credential theft
  • Possible privilege escalation and unauthorized configuration changes

Proof of Concept (PoC)

Inject the following payload into the ping input field and submit:

On page load, the injected JavaScript executes, demonstrating the lack of input sanitization.

Recommendations

• Implement strict server-side input validation and context-aware output encoding to prevent JavaScript injection.
• Prevent execution of arbitrary scripts in the admin interface inputs.
• Release a firmware update to address input sanitization issues.
• Advise users to update firmware promptly once a patch is available.
• Consider deploying Content Security Policy (CSP) headers to mitigate XSS impact.
• Restrict administrative access to trusted IP ranges.
• Educate users to avoid default or weak credentials.

Attack Vector

• Requires authenticated access to the router’s admin interface (e.g., via weak/default credentials or insider access),
  OR
• Can be exploited via Cross-Site Request Forgery (CSRF) if the victim is an authenticated admin who visits a malicious link.

The vulnerability is triggered by injecting malicious input into the "target IP" field on the Ping diagnostic page.

Impact

• Session hijacking via theft of authentication cookies.
• Privilege escalation through browser-based attacks.
• Unauthorized router configuration changes via injected JavaScript.
• Potential for CSRF attacks when combined with network access and victim interaction.

References

Disclosure

Disclosure timeline

Discovered and responsibly disclosed by Hasanka Amarasinghe

Disclaimer

This advisory is provided for security awareness and educational purposes only.