漏洞描述
MERCUSYS Mercury X18G 1.0.5 devices are vulnerable to local file inclusion via ../ in conjunction with a loginLess or login.htm URI (for authentication bypass) to the web server, as demonstrated by the /loginLess/../../etc/passwd URI.
影响产品
修复建议
建议关注厂商安全公告，及时升级至已修复版本，并结合实际资产暴露情况采取缓解措施。
参考链接
github.comhttps://github.com/BATTZION/MY_REQUEST/blob/master/Mercury%20Router%20Web%20Server%20Directory%20Traversal.md↗www.mercusys.comhttps://www.mercusys.com/en/↗www.mercurycom.com.cnhttps://www.mercurycom.com.cn/product-521-1.html↗nvd.nist.govhttps://nvd.nist.gov/vuln/detail/CVE-2021-23241↗github.comhttps://github.com/ARPSyndicate/kenzer-templates↗