CVE-2008-1247

23Vexday Risk Score

Sin señal de explotación. Ella tiene prueba de concepto pública.

ssvc Attendepss 5.2%

probabilidad de explotación

5.2%top 8% de las CVE

explotación observada

noninguna fuente lo reporta

2 exploit(s) público(s)

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri. NOTE: the Security.tri vector is already covered by CVE-2006-5202.

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2✓ VexDay Proof

cve_reference✓ VexDay Proofwww.exploit-db.com/exploits/5313 cve_referencewww.exploit-db.com/exploits/5926no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

Referencias

http://kinqpinz.info/lib/wrt54g/own.txt http://secunia.com/advisories/29344 https://exchange.xforce.ibmcloud.com/vulnerabilities/41118 https://kinqpinz.info/lib/wrt54g/https://kinqpinz.info/lib/wrt54g/own2.txt https://www.exploit-db.com/exploits/5313 https://www.exploit-db.com/exploits/5926 http://www.gnucitizen.org/projects/router-hacking-challenge/http://www.securityfocus.com/archive/1/489009/100/0/threaded http://www.securityfocus.com/bid/28381