Linksys WRT54GX V2.0 WAN Port UPnP Vulnerability
BID:20415
Info
Linksys WRT54GX V2.0 WAN Port UPnP Vulnerability
| Bugtraq ID: | 20415 |
| Class: | Design Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Oct 09 2006 12:00AM |
| Updated: | Oct 11 2006 06:54PM |
| Credit: | Armijn Hemel is credited with the discovery of this vulnerability. |
| Vulnerable: |
Linksys WRT54GXv2 2.0.5 |
| Not Vulnerable: | |
Discussion
Linksys WRT54GX V2.0 WAN Port UPnP Vulnerability
Linksys WRT54GX V2.0 is prone to a design vulnerability. Reportedly, the device offers Universal Plug and Play (UPnP) capabilities on both the LAN interface and the WAN Interface when UPnP is enabled.
The design problem manifests itself as a security issue since enabled UPnP services on a WAN interface allow a remote user to issue an 'AddPortMapping' command to the device. An attacker can exploit this vulnerability to establish arbitrary ingress port mappings to devices normally protected by the routing device.
This issue is reported to affect firmware version 2.00.05; other firmware versions may also be affected.
Linksys WRT54GX V2.0 is prone to a design vulnerability. Reportedly, the device offers Universal Plug and Play (UPnP) capabilities on both the LAN interface and the WAN Interface when UPnP is enabled.
The design problem manifests itself as a security issue since enabled UPnP services on a WAN interface allow a remote user to issue an 'AddPortMapping' command to the device. An attacker can exploit this vulnerability to establish arbitrary ingress port mappings to devices normally protected by the routing device.
This issue is reported to affect firmware version 2.00.05; other firmware versions may also be affected.
Exploit / POC
Linksys WRT54GX V2.0 WAN Port UPnP Vulnerability
Attackers may exploit this issue using a command-line tool that allows them to issue UPnP commands directly.
Attackers may exploit this issue using a command-line tool that allows them to issue UPnP commands directly.
Solution / Fix
Linksys WRT54GX V2.0 WAN Port UPnP Vulnerability
Solution:
The vendor has released firmware that addresses this issue. Please see the vendor references for more information.
Linksys WRT54GXv2 2.0.5
Solution:
The vendor has released firmware that addresses this issue. Please see the vendor references for more information.
Linksys WRT54GXv2 2.0.5
-
Linksys WRT54GX - Wireless-G Broadband Router with SRX Firmware
http://www.linksys.com/servlet/Satellite?c=L_Download_C2&childpagename =US%2FLayout&cid=1115417109974&packedargs=sku=1121811346959&pagename=L inksys%2FCommon%2FVisitorWrapper