medium5.0Public exploit code
CVE-2006-5202
Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Linksys WRT54G Firmware 1.00.9 - Security Bypass (2)2008-06-24 · remote · hardware · Verified
Impact
Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Linksys | Wrt54g | Version 1.00.9 |
References
- NVD record
- CVE.org record
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048495.html
- http://secunia.com/advisories/21372
- http://securitytracker.com/id?1016638
- http://www.kb.cert.org/vuls/id/930364
- http://www.securityfocus.com/bid/19347
- https://kinqpinz.info/lib/wrt54g/
- https://kinqpinz.info/lib/wrt54g/own2.txt
- https://www.exploit-db.com/exploits/5926
- http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048495.html
- http://secunia.com/advisories/21372
- http://securitytracker.com/id?1016638
- http://www.kb.cert.org/vuls/id/930364
- http://www.securityfocus.com/bid/19347
- https://kinqpinz.info/lib/wrt54g/
- https://kinqpinz.info/lib/wrt54g/own2.txt
- https://www.exploit-db.com/exploits/5926