linksys Archives - CVE Vulnerability

CVE-2019-7579

Sun, 26 Feb 2023 06:34:18 +0000

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dynamic/js/setup.js.localized file on the router’s webserver, allowing for an attacker to identify possible passwords that the system uses to set the default guest network password. An attacker can use this list of 30 words along with a random 2 digit number to brute force their access onto a router’s guest network.

The post CVE-2019-7579 appeared first on CVE Vulnerability.

CVE-2019-7311

Sun, 26 Feb 2023 06:34:14 +0000

An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored on a victim’s computer results in the admin password being discoverable by a local attacker, and usable to gain administrative access to the victim’s router. The admin password is stored in base64 cleartext in an “admin-auth” cookie. An attacker sniffing the network at the time of login could acquire the router’s admin password. Alternatively, gaining physical access to the victim’s computer soon after an administrative login could result in compromise.

The post CVE-2019-7311 appeared first on CVE Vulnerability.

CVE-2019-16340

Sun, 26 Feb 2023 06:31:15 +0000

Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI.

The post CVE-2019-16340 appeared first on CVE Vulnerability.

CVE-2019-11535

Sun, 26 Feb 2023 06:29:34 +0000

Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote command execution. An attacker can access system OS configurations and commands that are not intended for use beyond the web UI.

The post CVE-2019-11535 appeared first on CVE Vulnerability.