PT-2009-2292 · A Link · A-Link Wl54Ap2+1

Henri Lindberg + 1 · Published 2009-06-04 · Updated 2018-10-11 · CVE-2008-6823

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: A-LINK WL54AP3 versions prior to 1.4.2-eng1 A-LINK WL54AP2 versions prior to 1.4.2-eng1

Description: The issue concerns multiple cross-site request forgery (CSRF) vulnerabilities in the management interface of the affected access points. These vulnerabilities allow remote attackers to hijack the authentication of administrators for specific requests. The requests in question can modify the network configuration via certain parameters to "goform/formWanTcpipSetup" or modify credentials via certain parameters to "goform/formPasswordSetup".

Recommendations: For A-LINK WL54AP3 versions prior to 1.4.2-eng1, update to firmware version 1.4.2-eng1 or later. For A-LINK WL54AP2 versions prior to 1.4.2-eng1, update to firmware version 1.4.2-eng1 or later. As a temporary workaround, consider restricting access to the management interface to minimize the risk of exploitation. Avoid using the vulnerable parameters in the affected API endpoints until the issue is resolved.

Exploit

Fix

CSRF

Weakness Enumeration

CWE-352

Related Identifiers

CVE-2008-6823

Affected Products

A-Link Wl54Ap2

A-Link Wl54Ap3

References · 11

• 🔥 http://louhinetworks.fi/advisory/alink_081028.txt · Exploit
• 🔥 https://exploit-db.com/exploits/6899 · Exploit
• 🔥 http://securityfocus.com/bid/32008 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-6823 · Security Note
• http://secunia.com/advisories/32421 · Vendor Advisory
• http://osvdb.org/49465 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46255 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/46256 · Note
• http://osvdb.org/49466 · Note
• http://securityfocus.com/archive/1/497997/100/0/threaded · Note
• http://a-link.com/WL54AP3.html · Note