PT-2008-1488 · Linksys · Linksys Wrt350N

Publicado 2008-09-05 · Atualizado 2018-10-15 · CVE-2007-5474

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Média

Vetor base

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linksys WRT350N Wi-Fi access point with firmware version 2.00.17

Description The issue arises from the improper parsing of the Atheros vendor-specific information element in an association request by the driver for the Linksys WRT350N Wi-Fi access point. This can be exploited by remote authenticated users to cause a denial of service, resulting in a device reboot or hang, or potentially execute arbitrary code. The exploitation is possible via an Atheros information element with an invalid length.

Recommendations For Linksys WRT350N Wi-Fi access point with firmware version 2.00.17, consider applying a firmware update that addresses the improper parsing of Atheros vendor-specific information elements, if available. As a temporary workaround, restrict access to the device to minimize the risk of exploitation by unauthorized users.

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2007-5474

Produtos afetados

Linksys Wrt350N

Referências · 5

• http://securityfocus.com/archive/1/495984/100/0/threaded · Nota
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44921 · Nota
• http://securityfocus.com/bid/31012 · Nota
• http://securityreason.com/securityalert/4226 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2007-5474 · Nota de Segurança