{"api_version":"1","generated_at":"2026-07-23T07:46:56+00:00","cve":"CVE-2009-1561","urls":{"html":"https://cve.report/CVE-2009-1561","api":"https://cve.report/api/cve/CVE-2009-1561.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2009-1561","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2009-1561"},"summary":{"title":"CVE-2009-1561","description":"Cross-site request forgery (CSRF) vulnerability in administration.cgi on the Cisco Linksys WRT54GC router with firmware 1.05.7 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that change the administrator password via the sysPasswd and sysConfirmPasswd parameters.","state":"PUBLISHED","assigner":"mitre","published_at":"2009-05-06 16:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-352","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://packetstormsecurity.org/0904-exploits/linksysadmin-passwd.txt","name":"http://packetstormsecurity.org/0904-exploits/linksysadmin-passwd.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"Files ≈ Packet Storm","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.falandodeseguranca.com/?p=17","name":"http://www.falandodeseguranca.com/?p=17","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Falando de Segurança  » Blog Archive   » Linksys WRT54GC: Vulnerabilidade no Web Admin","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://archives.neohapsis.com/archives/bugtraq/2009-04/0198.html","name":"http://archives.neohapsis.com/archives/bugtraq/2009-04/0198.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/34616","name":"http://www.securityfocus.com/bid/34616","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Exploit"],"title":"504 Gateway Time-out","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2009/1172","name":"http://www.vupen.com/english/advisories/2009/1172","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/34805","name":"http://secunia.com/advisories/34805","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Vendor Advisory"],"title":"Linksys WRT54GC \"administration.cgi\" Security Bypass Vulnerability - Secunia Advisories - Vulnerability Information - Secunia.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2009-1561","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2009-1561","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2009","cve_id":"1561","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"h","cpe4":"cisco","cpe5":"wrt54gc","cpe6":"1.05.7","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T05:20:33.452Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20090418 Linksys WRT54GC - Admin Password Change (POC)","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://archives.neohapsis.com/archives/bugtraq/2009-04/0198.html"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://packetstormsecurity.org/0904-exploits/linksysadmin-passwd.txt"},{"name":"ADV-2009-1172","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2009/1172"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.falandodeseguranca.com/?p=17"},{"name":"34616","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/34616"},{"name":"34805","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/34805"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"descriptions":[{"lang":"en","value":"Cross-site request forgery (CSRF) vulnerability in administration.cgi on the Cisco Linksys WRT54GC router with firmware 1.05.7 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that change the administrator password via the sysPasswd and sysConfirmPasswd parameters."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2009-05-06T16:00:00.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20090418 Linksys WRT54GC - Admin Password Change (POC)","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://archives.neohapsis.com/archives/bugtraq/2009-04/0198.html"},{"tags":["x_refsource_MISC"],"url":"http://packetstormsecurity.org/0904-exploits/linksysadmin-passwd.txt"},{"name":"ADV-2009-1172","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2009/1172"},{"tags":["x_refsource_MISC"],"url":"http://www.falandodeseguranca.com/?p=17"},{"name":"34616","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/34616"},{"name":"34805","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/34805"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2009-1561","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site request forgery (CSRF) vulnerability in administration.cgi on the Cisco Linksys WRT54GC router with firmware 1.05.7 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that change the administrator password via the sysPasswd and sysConfirmPasswd parameters."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20090418 Linksys WRT54GC - Admin Password Change (POC)","refsource":"BUGTRAQ","url":"http://archives.neohapsis.com/archives/bugtraq/2009-04/0198.html"},{"name":"http://packetstormsecurity.org/0904-exploits/linksysadmin-passwd.txt","refsource":"MISC","url":"http://packetstormsecurity.org/0904-exploits/linksysadmin-passwd.txt"},{"name":"ADV-2009-1172","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2009/1172"},{"name":"http://www.falandodeseguranca.com/?p=17","refsource":"MISC","url":"http://www.falandodeseguranca.com/?p=17"},{"name":"34616","refsource":"BID","url":"http://www.securityfocus.com/bid/34616"},{"name":"34805","refsource":"SECUNIA","url":"http://secunia.com/advisories/34805"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2009-1561","datePublished":"2009-05-06T16:00:00.000Z","dateReserved":"2009-05-06T00:00:00.000Z","dateUpdated":"2024-09-17T01:11:40.144Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2009-05-06 16:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-352","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:h:cisco:wrt54gc:1.05.7:*:*:*:*:*:*:*","matchCriteriaId":"14D5B1F5-59CF-469F-B889-A802E6262341"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2009","CveId":"1561","Ordinal":"1","Title":"CVE-2009-1561","CVE":"CVE-2009-1561","Year":"2009"},"notes":[{"CveYear":"2009","CveId":"1561","Ordinal":"1","NoteData":"Cross-site request forgery (CSRF) vulnerability in administration.cgi on the Cisco Linksys WRT54GC router with firmware 1.05.7 allows remote attackers to hijack the intranet connectivity of arbitrary users for requests that change the administrator password via the sysPasswd and sysConfirmPasswd parameters.","Type":"Description","Title":"CVE-2009-1561"},{"CveYear":"2009","CveId":"1561","Ordinal":"2","NoteData":"2009-05-06","Type":"Other","Title":"Published"}]}}}