A critical access control vulnerability in the Each Italy Wireless Mini Router allows unauthenticated remote attackers to compromise administrative account security.

The device suffers from an incorrect access control vulnerability in the web management interface, which allows an unauthenticated attacker to change the administrative username and password by sending a specifically crafted GET request to the device.

Successful exploitation of this vulnerability grants an attacker full control over the router, leading to a complete compromise of network traffic, unauthorized access to internal resources, and potential interception of sensitive data. With a CVSS score of 7.5, this high-severity flaw represents a significant risk to organizational infrastructure, as it bypasses all authentication mechanisms to facilitate unauthorized administrative access.

Immediate Action: Since no official patch is currently available, administrators should restrict access to the web management interface by placing the device behind a firewall or disabling remote management entirely.

Proactive Monitoring: Monitor network traffic for unusual GET requests directed at administrative endpoints and review device logs for unexpected changes to account configurations.

Compensating Controls: Implement network-level access control lists to ensure that only trusted management IP addresses can reach the router interface, mitigating the risk of exposure to unauthorized external actors.

Public Exploit Available: Yes, a proof-of-concept is available via the researcher's GitHub repository.

Given the lack of a vendor-supplied patch and the presence of a public proof-of-concept, this vulnerability poses an immediate threat to the integrity of affected network devices. Security teams should prioritize isolating these routers from public-facing networks until a firmware update is released, as the ability for an unauthenticated user to reset administrative credentials constitutes a total security failure for the affected hardware.