# Teradici and CVE-2020-10965: An issue of routing.

Unauthenticated /login/resetadminpassword route in Teradici PCoIP Management Console let anyone reset the admin password and take over managed devices.

- Payout: $1,000
- Severity: critical
- Program: Teradici
- Credited: Benjamin Heald
- Disclosed: 2020-05-18
- CVE: CVE-2020-10965
- Write-up quality: 6/10
- Original: https://healdb.tech/blog/teradici.html
- Library page: https://bugbountylibrary.com/r/blog%3Ahealdb-tech-blog-teradici-html
- Tags: domain:web impact:ato impact:privesc kind:bounty platform:blog sev:critical technique:js-analysis technique:recon vuln:access-control vuln:auth-bypass

**Target:** Web management console login/resetadminpassword endpoint
**Root cause:** A client-side routing entry exposed an admin password reset endpoint that lacked authentication checks, so the reset form was reachable without login.
**Steps:**
1. Enumerate subdomains with Aquatone; find mc.* host with ports 80/443 open serving a JS-framework login page
2. Inspect the JS routing files via Chrome devtools for endpoints not redirecting to login
3. Identify route `/login/resetadminpassword`
4. Navigate to `https://mc.target/login/resetadminpassword` unauthenticated
5. Submit the reset form to set a new admin password
**How found:** Recon with Aquatone found a management console subdomain; noticing a JS framework, the researcher read the client-side routing files looking for endpoints, and spotted a resetadminpassword route that did not redirect to login.
**Exploitation:** Unauthenticated attacker browses directly to /login/resetadminpassword, submits the form to set the admin password, then logs in as admin and controls PCoIP Zero Clients and Remote Workstation Cards managed by the console.
**Escalation:** Admin console access extends to controlling all managed PCoIP endpoints.
**Insight:** Client-side JS route tables often enumerate privileged endpoints; grep the router config for paths like reset/forgot/admin and test each directly unauthenticated rather than only through the UI.