CVE Vulnerability

CVE-2008-1247

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri. NOTE: the Security.tri vector is already covered by CVE-2006-5202.

10 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 10 / Impact : 10

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

Scope

References
Link Resource
http://kinqpinz.info/lib/wrt54g/own.txt Exploit
http://www.gnucitizen.org/projects/router-hacking-challenge/
http://www.securityfocus.com/bid/28381
http://secunia.com/advisories/29344
https://kinqpinz.info/lib/wrt54g/own2.txt
https://kinqpinz.info/lib/wrt54g/
https://exchange.xforce.ibmcloud.com/vulnerabilities/41118
https://www.exploit-db.com/exploits/5926
https://www.exploit-db.com/exploits/5313
http://www.securityfocus.com/archive/1/489009/100/0/threaded
Configurations

Configuration 1

cpe:2.3:h:linksys:wrt54g:*:*:1.00.9:*:*:*:*:*
Information

Published : 2008-03-10 05:44

Updated : 2018-10-11 08:31

NVD link : CVE-2008-1247

Mitre link : CVE-2008-1247

Products Affected
No products.
CWE
CWE-264