PT-2020-7413 · Cisco · Linksys E4200

Published 2020-02-18 · Updated 2020-02-27 · CVE-2013-2679

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Cisco Linksys E4200 router version 1.0.05 build 7

Description: Multiple cross-site scripting (XSS) vulnerabilities allow remote attackers to inject arbitrary web script or HTML via vulnerable parameters. The affected parameters include log type, ping ip, ping size, submit type, traceroute ip, new workgroup, and submit button in the "apply.cgi" or "storage/apply.cgi" API endpoints, such as "apply.cgi" and "storage/apply.cgi".

Recommendations: For version 1.0.05 build 7, consider disabling access to the "apply.cgi" and "storage/apply.cgi" API endpoints until a patch is available. Restrict input for the log type, ping ip, ping size, submit type, traceroute ip, new workgroup, and submit button parameters to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2013-2679

Affected Products

Linksys E4200

References · 10

• 🔥 https://exploit-db.com/exploits/25292 · Exploit
• 🔥 http://packetstormsecurity.com/files/121551/Cisco-Linksys-E4200-Cross-Site-Scripting-Local-File-Inclusion.html · Exploit
• 🔥 https://exploit-db.com/exploits/38501 · Exploit
• 🔥 https://exploit-db.com/exploits/24202 · Exploit
• 🔥 http://cloudscan.me/2013/05/xss-lfi-linksys-e4200-firmware-0d.html · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2013-2679 · Security Note
• https://t.me/cibsecurity/9899 · Telegram Post
• http://osvdb.org/93059 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/84069 · Note
• http://osvdb.org/93060 · Note