The KuWFi 4G LTE AC900 router 1.0.13 is vulnerable to Cross-Site Request Forgery (CSRF) on its web management interface. This vulnerability allows an attacker to trick an authenticated admin user into performing unauthorized actions, such as exploiting a command injection vulnerability in
 /goform/formMultiApnSetting. Successful exploitation can also lead to unauthorized configuration changes.
------------------------------------------
>
> [VulnerabilityType Other]
> CWE-352: Cross-Site Request Forgery (CSRF)
>
> ------------------------------------------
>
> [Vendor of Product]
> KuWFi
>
> ------------------------------------------
>
> [Affected Product Code Base]
> "KuWFi 4G LTE Router" Model AC900 - Firmware Version: V1.0.13
>
> ------------------------------------------
>
> [Affected Component]
> Web management interface of the router.
>
> ------------------------------------------
>
> [Attack Type]
> Remote
>
> ------------------------------------------
>
> [Impact Code execution]
> true
>
> ------------------------------------------
>
> [Impact Denial of Service]
> true
>
> ------------------------------------------
>
> [Impact Information Disclosure]
> true
>
> ------------------------------------------
>
> [Attack Vectors]
> An attacker can exploit this vulnerability by tricking an authenticated user into visiting a malicious webpage containing an auto-submitted form. For example:
> The form could issue a POST request to /goform/formMultiApnSetting with a payload like pincode=$(telnetd), enabling telnet services or modifying critical router configurations.
> This is possible due to the lack of CSRF protection (e.g., missing CSRF tokens) and failure to validate the Referrer or Origin headers.
>
> ------------------------------------------
>
> [Reference]
> https://kuwfi.com/products/kuwfi-gigabit-wireless-router-4g-lte-wifi-router-dual-band-portable-wifi-modem-hotspot-64-user-with-gigabit-wan-lan-rj11-port
> https://github.com/actuator/cve/tree/main/Kuwfi
>
> ------------------------------------------
>
> [Discoverer]
> Edward Warren