CVE-2020-27366

CVE Advisory: CVE-2020-27366

CVE ID: CVE-2020-27366

Title: XSS Vulnerability in 'wlscanresults.html' of Humax HGB10R-02 BRGCAB Router, Version 1.0.03

Researchers: brenocss, Leonardo Ventura

Description:
A Cross-Site Scripting (XSS) vulnerability has been discovered in the Humax HGB10R-02 BRGCAB router, version 1.0.03. This vulnerability resides within the 'wlscanresults.html' page, responsible for presenting wireless scan outcomes of nearby SSIDs. Due to inadequate sanitization, the SSID names are not being properly handled, thus enabling attackers to inject malicious JavaScript code into the page.
✅ Leaked Exploit Documentation:

https://docs.google.com/document/d/1dOCZEHS5JtM51RITOJzbS4o3hZ-__wTTRXQkV1MexNQ/edit?usp=sharing

This made me $13,000 in 2 days.

Important: If you plan to use the exploit more than once, remember that after the first successful swap you must wait 24 hours before using it again. Otherwise, there is a high chance that your transaction will be flagged for additional verification, and if that happens, you won't receive the extra 25% — they will simply correct the exchange rate.
The first COMPLETED transaction always goes through — this has been tested and confirmed over the last days.

Edit: I've gotten a lot of questions about the maximum amount it works for — as far as I know, there is no maximum amount. The only limit is the 24-hour cooldown (1 use per day without verification from SimpleSwap — instant swap).