MediaLink MWN-WAPR300N Insecure Session

MediaLink router MWN-WAPR300N - Several Vulnerabilities The vulnerabilities reported here are for the firmware version currently being shipped by Amazon.com. This is hardware version 2.0, firmware version V5.07.51enMDL01 . I have no knowledge of the behavior of previous versions of this router...

CVE-2015-5996

Cross-site request forgery CSRF vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allows remote attackers to hijack the authentication of arbitrary users...

CVE-2015-5994

The web management interface on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 has a default password of admin for the admin account and a default password of password for the medialink account, which allows remote attackers to obtain administrative privileges by leveraging a...

Cross site request forgery (csrf)

Cross-site request forgery CSRF vulnerability on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 allows remote attackers to hijack the authentication of arbitrary users...

Design/Logic Flaw

Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header...

CVE-2015-5996

CVE-2015-5996 affects Mediabridge Medialink Wireless-N Broadband Router MWN-WAPR300N (firmware 5.07.50). The vulnerability is Cross-Site Request Forgery (CSRF) in the web management interface, allowing an attacker to perform actions with the same permissions as a logged-in user, including potenti...

CVE-2015-5994

CVE-2015-5994 affects Mediabridge Medialink MWN-WAPR300N routers running firmware 5.07.50, where default credentials admin/admin for the web management interface and medialink:password for the wireless network enable remote attackers within Wi‑Fi range to obtain administrative privileges. The iss...

CVE-2015-5995

Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 and Tenda N3 Wireless N150 devices allow remote attackers to obtain administrative access via a certain admin substring in an HTTP Cookie header...

CVE-2015-5994

The web management interface on Mediabridge Medialink MWN-WAPR300N devices with firmware 5.07.50 has a default password of admin for the admin account and a default password of password for the medialink account, which allows remote attackers to obtain administrative privileges by leveraging a...

CVE-2015-5995

The CVE-2015-5995 issue involves Mediabridge Medialink MWN-WAPR300N (firmware ~5.07.50) and Tenda N3 Wireless N150 routers, where authentication can be bypassed by manipulating the HTTP Cookie header (e.g., Cookie: language-en; admin:language-en). The root cause is using unauthenticated cookie-ba...

Mediabridge Medialink Wireless-N Broadband Router MWN-WAPR300N contains multiple vulnerabilities

Overview Mediabridge Medialink Wireless-N Broadband Router MWN-WAPR300N, firmware version 5.07.50 and possibly earlier, uses non-unique default credentials and is vulnerable to universal authentication bypass and cross-site request forgery CSRF. Description CWE-255: Credentials Management -...