Cisco Linksys WRT54GL Router Multiple Security Vulnerabilities
BID:57459
Info
Cisco Linksys WRT54GL Router Multiple Security Vulnerabilities
| Bugtraq ID: | 57459 |
| Class: | Input Validation Error |
| CVE: | |
| Remote: | Yes |
| Local: | No |
| Published: | Jan 18 2013 12:00AM |
| Updated: | Apr 10 2013 06:18AM |
| Credit: | m-1-k-3 |
| Vulnerable: | |
| Not Vulnerable: | |
Discussion
Cisco Linksys WRT54GL Router Multiple Security Vulnerabilities
Cisco Linksys WRT54GL Router is prone to the following security vulnerabilities:
1. A command-execution vulnerability
2. A security-bypass vulnerability
3. A cross-site request-forgery vulnerability
4. A cross-site scripting vulnerability
5. An HTML-injection vulnerability
An attacker can exploit these issues to execute arbitrary commands, bypass certain security restrictions, steal cookie-based authentication credentials, or perform unauthorized actions in the context of a user session.
Cisco Linksys WRT54GL 1.1 running firmware version 4.30.15 build 2 is vulnerable; other versions may also be affected.
Cisco Linksys WRT54GL Router is prone to the following security vulnerabilities:
1. A command-execution vulnerability
2. A security-bypass vulnerability
3. A cross-site request-forgery vulnerability
4. A cross-site scripting vulnerability
5. An HTML-injection vulnerability
An attacker can exploit these issues to execute arbitrary commands, bypass certain security restrictions, steal cookie-based authentication credentials, or perform unauthorized actions in the context of a user session.
Cisco Linksys WRT54GL 1.1 running firmware version 4.30.15 build 2 is vulnerable; other versions may also be affected.
Exploit / POC
Cisco Linksys WRT54GL Router Multiple Security Vulnerabilities
An attacker can exploit these issues through a browser. To exploit cross-site scripting and cross-sire request-forgery issues, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URI and an exploit code is available:
http://www.example.com/apply.cgi?submit_button=Filters&change_action=&submit_type=save&action=Apply&blocked_service=&filter_web=&filter_policy=&f_status=0&f_id=1&f_status1=disable&f_name=123">&f_status2=allow&day_all=1&time_all=1&allday=&blocked_service0=None&blocked_service1=None&host0=&host1=&host2=&host3=&url0=&url1=&url2=&url3=&url4=&url5=
An attacker can exploit these issues through a browser. To exploit cross-site scripting and cross-sire request-forgery issues, the attacker must entice an unsuspecting victim to follow a malicious URI.
The following example URI and an exploit code is available:
http://www.example.com/apply.cgi?submit_button=Filters&change_action=&submit_type=save&action=Apply&blocked_service=&filter_web=&filter_policy=&f_status=0&f_id=1&f_status1=disable&f_name=123">&f_status2=allow&day_all=1&time_all=1&allday=&blocked_service0=None&blocked_service1=None&host0=&host1=&host2=&host3=&url0=&url1=&url2=&url3=&url4=&url5=
Solution / Fix
Cisco Linksys WRT54GL Router Multiple Security Vulnerabilities
Solution:
Vendor updates are available. Please see the references for more information.
Solution:
Vendor updates are available. Please see the references for more information.
References
Cisco Linksys WRT54GL Router Multiple Security Vulnerabilities
References:
References: