PT-2009-4051 · Cisco · Linksys Wvc54Gca

Pagvac · Publicado 2009-05-06 · Atualizado 2017-08-17 · CVE-2009-1557

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Linksys WVC54GCA wireless video camera version 1.00R22 Cisco Linksys WVC54GCA wireless video camera version 1.00R24

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the next file parameter to API endpoints such as "main.cgi", "img/main.cgi", or "adm/file.cgi", or the this file parameter to the "adm/file.cgi" endpoint.

Recommendations: For version 1.00R22, avoid using the next file parameter in the "main.cgi", "img/main.cgi", and "adm/file.cgi" API endpoints, and the this file parameter in the "adm/file.cgi" endpoint until a patch is available. For version 1.00R24, avoid using the next file parameter in the "main.cgi", "img/main.cgi", and "adm/file.cgi" API endpoints, and the this file parameter in the "adm/file.cgi" endpoint until a patch is available.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2009-1557

Produtos afetados

Linksys Wvc54Gca

Referências · 7

• 🔥 http://gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-4 · Exploit
• 🔥 https://exploit-db.com/exploits/32955 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1557 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50224 · Nota
• http://secunia.com/advisories/34767 · Aviso do Fabricante
• http://securityfocus.com/bid/34714 · Nota
• http://vupen.com/english/advisories/2009/1173 · Aviso do Fabricante