PT-2009-4051 · Cisco · Linksys Wvc54Gca

Pagvac · Published 2009-05-06 · Updated 2017-08-17 · CVE-2009-1557

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Linksys WVC54GCA wireless video camera version 1.00R22 Cisco Linksys WVC54GCA wireless video camera version 1.00R24

Description: The issue concerns multiple cross-site scripting (XSS) vulnerabilities. These vulnerabilities allow remote attackers to inject arbitrary web script or HTML. This can be achieved via the next file parameter to API endpoints such as "main.cgi", "img/main.cgi", or "adm/file.cgi", or the this file parameter to the "adm/file.cgi" endpoint.

Recommendations: For version 1.00R22, avoid using the next file parameter in the "main.cgi", "img/main.cgi", and "adm/file.cgi" API endpoints, and the this file parameter in the "adm/file.cgi" endpoint until a patch is available. For version 1.00R24, avoid using the next file parameter in the "main.cgi", "img/main.cgi", and "adm/file.cgi" API endpoints, and the this file parameter in the "adm/file.cgi" endpoint until a patch is available.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2009-1557

Affected Products

Linksys Wvc54Gca

References · 7

• 🔥 http://gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-4 · Exploit
• 🔥 https://exploit-db.com/exploits/32955 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2009-1557 · Security Note
• http://secunia.com/advisories/34767 · Vendor Advisory
• http://vupen.com/english/advisories/2009/1173 · Vendor Advisory
• https://exchange.xforce.ibmcloud.com/vulnerabilities/50224 · Note
• http://securityfocus.com/bid/34714 · Note