CVE-2008-1247
First published: Mon Mar 10 2008(Updated: )
The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri. NOTE: the Security.tri vector is already covered by CVE-2006-5202.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Linksys WRT54G |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://kinqpinz.info/lib/wrt54g/own.txt
- http://www.gnucitizen.org/projects/router-hacking-challenge/
- http://www.securityfocus.com/bid/28381
- http://secunia.com/advisories/29344
- https://kinqpinz.info/lib/wrt54g/own2.txt
- https://kinqpinz.info/lib/wrt54g/
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41118
- https://www.exploit-db.com/exploits/5926
- https://www.exploit-db.com/exploits/5313
- http://www.securityfocus.com/archive/1/489009/100/0/threaded
- collector/nvd-historical
- collector/nvd-index
- agent/references
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/severity
- agent/last-modified-date
- agent/author
- agent/weakness
- agent/description
- agent/tags
- agent/first-publish-date
- agent/event
- agent/source
- vendor/linksys
- canonical/linksys wrt54g