Independent security researcher Dawid Golunski has released Vulnerability-related.DiscoverVulnerability a proof-of-concept exploit code for an unauthenticated remote code execution vulnerability in WordPress 4.6 ( CVE-2016-10033 ) , and information about an unauthorized password reset zero-day vulnerability ( CVE-2017-8295 ) in the latest version of the popular CMS . The vulnerability exists in Vulnerability-related.DiscoverVulnerability the PHPMailer library , and can be exploited Vulnerability-related.DiscoverVulnerability by unauthenticated remote attackers to gain access to and compromise an target application server on which a vulnerable WordPress Core version is installed ( in its default configuration ) . “ No plugins or non-standard settings are required to exploit the vulnerability , ” Golunski noted . The hole has been responsibly disclosed Vulnerability-related.DiscoverVulnerability to the WordPress Foundation , and has been plugged Vulnerability-related.PatchVulnerability in January , with the release of WordPress 4.7.1 . Still , according to the Foundation ’ s own numbers , nearly 11 percent of all WordPress installation out there are still stuck on the vulnerable version 4.6 . And , as Golunski noted Vulnerability-related.DiscoverVulnerability , it ’ s possible that older WordPress versions are also affected Vulnerability-related.DiscoverVulnerability by the same flaw , so the percentage of vulnerable installations could be considerably higher : Admins who still run these older versions of the popular CMS should upgrade Vulnerability-related.PatchVulnerability to newer versions , ideally to the latest one ( v4.7.4 ) . Still , even that might not be a guarantee against compromise , as Golunski has also publicly released Vulnerability-related.DiscoverVulnerability information and POC code for an unauthorized password reset vulnerability ( CVE-2017-8295 ) that the WordPress Foundation is yet to patch Vulnerability-related.PatchVulnerability . According to him and BeyondSecurity , whose SecuriTeam coordinated the disclosure Vulnerability-related.DiscoverVulnerability of the flaw to the WordPress developers , the discovery Vulnerability-related.DiscoverVulnerability of the vulnerability dates back to mid-2016 . Golunski found Vulnerability-related.DiscoverVulnerability it in version 4.3.1 of the CMS . “ WordPress has a password reset feature that contains Vulnerability-related.DiscoverVulnerability a vulnerability which might in some cases allow attackers to get hold of the password reset link without previous authentication . Such attack could lead to an attacker gaining unauthorized access to a victim ’ s WordPress account , ” BeyondSecurity explained . “ The vulnerability stems from WordPress using untrusted data by default when creating a password reset e-mail that is supposed to be delivered only to the e-mail associated with the owner ’ s account. ” Golunski says Vulnerability-related.DiscoverVulnerability that the issue was reported Vulnerability-related.DiscoverVulnerability to the WordPress security team multiple times , but they did not confirm whether it has been patched Vulnerability-related.PatchVulnerability . He ultimately decided to publish Vulnerability-related.DiscoverVulnerability his findings , and offer Vulnerability-related.PatchVulnerability a temporary solution ( “ users can enable UseCanonicalName to enforce static SERVER_NAME value ” ) .

Details on serious vulnerabilities in a number of routers freely distributed by a major Thai ISP were published on Vulnerability-related.DiscoverVulnerability Monday after private disclosures Vulnerability-related.DiscoverVulnerability made to the vendors in July went unanswered . Researcher Pedro Ribeiro of Agile Information Security found Vulnerability-related.DiscoverVulnerability accessible admin accounts and command injection vulnerabilities in ZyXel and Billion routers distributed by TrueOnline , Thailand ’ s largest broadband company . Ribeiro said Vulnerability-related.DiscoverVulnerability he disclosed Vulnerability-related.DiscoverVulnerability the vulnerabilities through Beyond Security ’ s SecuriTeam Secure Disclosure Program , which contacted the affected vendors last July . Ribeiro published Vulnerability-related.DiscoverVulnerability a proof of concept exploit yesterday as well . Ribeiro told Vulnerability-related.DiscoverVulnerability Threatpost he ’ s unsure whether TrueOnline introduced Vulnerability-related.DiscoverVulnerability the vulnerabilities as it adds its own customization to the routers , or whether they came from the respective manufacturers . A ZyXel representative told Threatpost the router models are no longer supported and would not comment on whether patches were being developed Vulnerability-related.PatchVulnerability . A request for comment from Billion was not returned in time for publication . The commonality between the routers appears to be that they ’ re all based on the TC3162U system-on-a-chip manufactured by TrendChip . Affected routers are the ZyXel P660HN-T v1 and P660HN-T v2 , and Billion 5200 W-T , currently in distribution to TrueOnline customers . The TC3162U chips run two different firmware variants , one called “ ras ” which includes the Allegro RomPage webserver vulnerable to the Misfortne Cookie attacks , and the other called tclinux . The tclinux variant contains the vulnerabilities found Vulnerability-related.DiscoverVulnerability by Ribeiro , in particular several ASP files , he said Vulnerability-related.DiscoverVulnerability , are vulnerable Vulnerability-related.DiscoverVulnerability to command injection attacks . He also cautions that they could be also vulnerable to Misfortune Cookie , but he did not investigate this possibility . “ It should be noted that tclinux contains files and configuration settings in other languages ( for example in Turkish ) . Therefore it is likely that these firmware versions are not specific to TrueOnline , and other ISP customised routers in other countries might also be vulnerable , ” Ribeiro said in his advisory . “ It is also possible that other brands and router models that use the tclinux variant are also affected Vulnerability-related.DiscoverVulnerability by the command injection vulnerabilities ( the default accounts are likely to be TrueOnline specific ) ” . In addition to Ribeiro ’ s proof-of-concept , Metasploit modules are available Vulnerability-related.DiscoverVulnerability for three of the vulnerabilities . Most of the vulnerabilities can be exploited Vulnerability-related.DiscoverVulnerability remotely , some without authentication . “ These vulnerabilities are present in the web interface . The default credentials are part of the firmware deployed by TrueOnline and they are authorized to perform remote access over the WAN , ” Ribeiro said . “ Due to time and lab constraints I was unable to test whether these routers expose the web interface over the WAN , but given the credentials , it is likely ” . The ZyXel P660HN-T v1 router is vulnerable Vulnerability-related.DiscoverVulnerability to an unauthenticated command injection attack that can be exploited remotely . Ribeiro said Vulnerability-related.DiscoverVulnerability he found Vulnerability-related.DiscoverVulnerability the vulnerability in the remote system log forwarding function , specifically in the ViewLog.asp page . V2 of the same router contains Vulnerability-related.DiscoverVulnerability the same vulnerability , but can not be exploited Vulnerability-related.DiscoverVulnerability without authentication , he said . “ Unlike in the P660HN-Tv1 , the injection is authenticated and in the logSet.asp page . However , this router contains a hardcoded supervisor password that can be used to exploit this vulnerability , ” Ribeiro said . “ The injection is in the logSet.asp page that sets up remote forwarding of syslog logs , and the parameter vulnerable to injection is the serverIP parameter ” . The Billion 5200W-T is also vulnerable Vulnerability-related.DiscoverVulnerability to unauthenticated and authenticated command injection attacks ; the vulnerability was found Vulnerability-related.DiscoverVulnerability in its adv_remotelog.asp page . “ The Billion 5200W-T router also has several other command injections in its interface , depending on the firmware version , such as an authenticated command injection in tools_time.asp ( uiViewSNTPServer parameter ) , ” Ribeiro said . It should be noted that this router contains several hardcoded administrative accounts that can be used to exploit this vulnerability ” . Ribeiro said default and weak admin credentials were found on the all of the versions and were accessible remotely . The researcher said it ’ s unknown whether the routers can be patched remotely . “ Again , given the existence of default credentials that have remote access , it is likely that it is possible to update the firmware remotely , ” Ribeiro said . Most of iBall baton routers in India are also vulnerable Vulnerability-related.DiscoverVulnerability to unauthenticated and authenticated command injection attack , i have reason to believe default and weak admin credentials are on the all of the versions and were accessible remotely . i Have I “ Ball WRA150N ” ADSL2+ iBall baton Router.And IBall is never accepting not even taking response to complains and request for latest firmware patches . ASUS patched Vulnerability-related.PatchVulnerability a bug that allowed attackers to pair two vulnerabilities to gain direct router access and execute commands as root . Thanks to Meltdown and Spectre , January has already been an extremely busy month of patching Vulnerability-related.PatchVulnerability for Microsoft .