PT-2008-1669 · Cisco · Cisco Linksys Wag54Gs Wireless-G Adsl Gateway

Published 2008-03-13 · Updated 2018-10-15 · CVE-2007-6708

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Cisco Linksys WAG54GS Wireless-G ADSL Gateway versions 1.01.03 and earlier

Description The issue allows remote attackers to perform actions as administrators via an arbitrary valid request to an administrative URI. This can be demonstrated by a Restore Factory Defaults action using the mtenRestore parameter to "setup.cgi" or creation of a user account using the sysname parameter to "setup.cgi".

Recommendations For Cisco Linksys WAG54GS Wireless-G ADSL Gateway versions 1.01.03 and earlier, consider disabling access to the "setup.cgi" endpoint until a patch is available. Restrict access to administrative URIs to minimize the risk of exploitation. Avoid using the mtenRestore and sysname parameters in the affected API endpoint until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2007-6708

Affected Products

Cisco Linksys Wag54Gs Wireless-G Adsl Gateway

References · 7

• 🔥 http://gnucitizen.org/projects/router-hacking-challenge · Exploit
• 🔥 http://gnucitizen.org/blog/persistent-xss-and-csrf-on-wireless-g-adsl-gateway-with-speedbooster-wag54gs · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2007-6708 · Security Note
• http://osvdb.org/43538 · Note
• http://securityfocus.com/archive/1/489009/100/0/threaded · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/41269 · Note
• http://osvdb.org/43537 · Note