PT-2008-1488 · Linksys · Linksys Wrt350N

Published 2008-09-05 · Updated 2018-10-15 · CVE-2007-5474

Positive Technologies (AI Summary)

CVSS v2.0

6.3

Medium

Base vector

AV:N/AC:M/Au:S/C:N/I:N/A:C

Name of the Vulnerable Software and Affected Versions Linksys WRT350N Wi-Fi access point with firmware version 2.00.17

Description The issue arises from the improper parsing of the Atheros vendor-specific information element in an association request by the driver for the Linksys WRT350N Wi-Fi access point. This can be exploited by remote authenticated users to cause a denial of service, resulting in a device reboot or hang, or potentially execute arbitrary code. The exploitation is possible via an Atheros information element with an invalid length.

Recommendations For Linksys WRT350N Wi-Fi access point with firmware version 2.00.17, consider applying a firmware update that addresses the improper parsing of Atheros vendor-specific information elements, if available. As a temporary workaround, restrict access to the device to minimize the risk of exploitation by unauthorized users.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2007-5474

Affected Products

Linksys Wrt350N

References · 5

• https://nvd.nist.gov/vuln/detail/CVE-2007-5474 · Security Note
• http://securityfocus.com/archive/1/495984/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/44921 · Note
• http://securityfocus.com/bid/31012 · Note
• http://securityreason.com/securityalert/4226 · Note