Conceptronic C54APM 2.0 Multiple Open Redirection Vulnerabilities

Bugtraq ID:	64794
Class:	Input Validation Error
CVE:	CVE-2014-1405
Remote:	Yes
Local:	No
Published:	Jan 09 2014 12:00AM
Updated:	Jan 09 2014 12:00AM
Credit:	Antonio Vázquez Blanco
Vulnerable:	Conceptronic C54APM 2.0 Firmware 1.26
Not Vulnerable:

Conceptronic C54APM 2.0 Multiple Open Redirection Vulnerabilities

Conceptronic C54APM 2.0 is prone to multiple open-redirection vulnerabilities because the application fails to properly sanitize user-supplied input.

An attacker can leverage these issues by constructing a crafted URI and enticing a user to follow it. When an unsuspecting victim follows the link, they may be redirected to an attacker-controlled site; this may aid in phishing attacks. Other attacks are possible.

Conceptronic C54APM 2.0 running firmware 1.26 is vulnerable.

Conceptronic C54APM 2.0 Multiple Open Redirection Vulnerabilities

An attacker can exploit these issues by enticing an unsuspecting victim to following a malicious URI.

Conceptronic C54APM 2.0 Multiple Open Redirection Vulnerabilities

Solution:
Currently, we are not aware of any vendor-supplied patches. If you feel we are in error or are aware of more recent information, please mail us at: [email protected].

Conceptronic C54APM 2.0 Multiple Open Redirection Vulnerabilities

References:

• Advisory C54APM Multiple (antoniovazquezblanco)
  
• C54APM Homepage (conceptronic)