# Exploit Title: HooToo Tripmate HT-TM01 Cross Site Request Forgery # Date: 03Sep15 # Exploit Author: Ken Smith # Contact: https://twitter.com/P4tchw0rk # Vendor Homepage: http://www.hootoo.com # Version: HT-TM01, version 2.000.022 1. Description Various functions in the device's admin web portal are vulnerable to Cross Site Request Forgery. Proof-of-concept HTML has been provided. In order for changes in wireless settings/security (executed via CSRF) to apply, a save and reset must be execute either by the admin manually saving the settings through the portal or via the save and reset CSRF-vulnerable functions described below. 2. Proof of Concept Change the device's hostname Change the region Log the admin user out Change the admin portal password Reboot the device Save changed settings Change WiFi Security Change network information