CVE-2008-1263

The CVE-2008-1263 issue concerns the Linksys WRT54G router, where passwords and keys are stored in cleartext in the Config.bin file. The underlying problem is that an HTTP request to the top-level Config.bin URI may allow remote authenticated users to obtain sensitive information. The available d...

CVE-2008-1265

The CVE-2008-1265 issue affects the Linksys WRT54G router. A remote attacker can trigger a denial of service (device restart) by sending an excessively long username and password to the FTP interface. The available sources confirm the vulnerability mechanism and impact, but do not provide exploit...

CVE-2008-1265

The Linksys WRT54G router allows remote attackers to cause a denial of service device restart via a long username and password to the FTP interface...

CVE-2008-1264

CVE-2008-1264 affects the Linksys WRT54G router. The issue is the default FTP password/passwordless-like access using “admin,” which permits remote access to sensitive files (including nvram.cfg, a file listing all HTML documents, and an ELF executable). The available documents describe the vulne...

CVE-2008-1264

The Linksys WRT54G router has "admin" as its default FTP password, which allows remote attackers to access sensitive files including nvram.cfg, a file that lists all HTML documents, and an ELF executable file...

CVE-2008-1268

The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote attackers to establish an FTP session by sending an arbitrary username and password...

CVE-2008-1268

CVE-2008-1268 affects the Linksys WRT54G v7 router running firmware 7.00.1. The FTP server fails to verify authentication credentials, allowing remote attackers to establish an FTP session by supplying an arbitrary username and password. This directly enables unauthorized access to FTP functional...

CVE-2008-1247: Undefined Security Weakness

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to 1 Advanced.tri, 2 AdvRoute.tri, 3 Basic.tri, 4 ctlog.tri, 5 ddns.tri, 6 dmz.tri...

CVE-2008-1265: Improper Input Validation

The Linksys WRT54G router allows remote attackers to cause a denial of service device restart via a long username and password to the FTP interface...

CVE-2008-1264: Improper Authentication

The Linksys WRT54G router has "admin" as its default FTP password, which allows remote attackers to access sensitive files including nvram.cfg, a file that lists all HTML documents, and an ELF executable file...

CVE-2008-1263: Undefined Security Weakness

The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file, which might allow remote authenticated users to obtain sensitive information via an HTTP request for the top-level Config.bin URI...

CVE-2008-1268: Improper Authentication

The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote attackers to establish an FTP session by sending an arbitrary username and password...

CVE-2006-5202

Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559...

CVE-2006-5202

Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559...

CVE-2006-5202

The vulnerability CVE-2006-5202 affects Linksys WRT54g with firmware 1.00.9, where the web interface does not require credentials for configuration changes. An attacker can issue a direct request to Security.tri (using parameters such as SecurityMode and layout) to modify arbitrary configurations...

CVE-2006-5202: Undefined Security Weakness

Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559...

Linksys WRT54G routers do not properly validate user credentials

Overview Linksys WRT54G routers do not properly validate user credentials before allowing configuration changes. Description The Linksys WRTG54G is a broadband router that has an integrated wireless access point and ethernet switch. The WRT54G router's configuration settings are controlled by a w...

[Full-disclosure] linksys WRT54g authentication bypass

I'm having some trouble believing this hasn't been reported before. If you have a linksys router handy, please check to see whether it is vulnerable to this attack. It's possible that all of the linksys router web UIs have the same bug. Hopefully the problem is isolated to one particular model or...

Authentication flaw

Linksys WRT54G Wireless-G Broadband Router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic...

CVE-2006-2559

Linksys WRT54G Wireless-G Broadband Router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP request with a modified InternalClient parameter, which is not validated, as demonstrated by using AddPortMapping to forward arbitrary traffic...