alert http any any -> $HOME_NET any (msg:"ET EXPLOIT 2Wire Password Reset Vulnerability via POST"; flow:established,to_server; http.uri; content:"/xslt"; http.request_body; content:"PAGE=H04_POST&THISPAGE=H04&NEXTPAGE="; fast_pattern; content:"&PASSWORD="; distance:0; content:"&PASSWORD_CONF="; distance:0; reference:url,www.seguridad.unam.mx/doc/?ap=articulo&id=196; reference:url,packetstormsecurity.org/files/view/102614/2wire-reset.rb.txt; classtype:attempted-admin; sid:2013166; rev:3; metadata:created_at 2011_07_01, signature_severity Major, tag Description_Generated_By_Proofpoint_Nexus, updated_at 2024_03_05;)