Details of VAR-200610-0506

ID

VAR-200610-0506

CVE

CVE-2006-5202

TITLE

Linksys WRT54G routers do not properly validate user credentials

Trust: 0.8

sources: CERT/CC: VU#930364

DESCRIPTION

Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559. Linksys WRT54G routers do not properly validate user credentials before allowing configuration changes. This vulnerability CVE-2006-2559 Is a different vulnerability.By a third party Security.tri Any setting may be changed through a direct request to. Linksys WRT54GS is prone to an authentication-bypass vulnerability. Reportedly, the device permits changes in its configuration settings without requring authentication. Linksys WRT54GS is prone to an authentication-bypass vulnerability. The problem presents itself when a victim user visits a specially crafted web page on an attacker-controlled site. An attacker can exploit this vulnerability to bypass authentication and modify the configuration settings of the device. This issue is reported to affect firmware version 1.00.9; other firmware versions may also be affected. Linksys WRT54GS is a wireless router device that combines several functions. ---------------------------------------------------------------------- Hardcore Disassembler / Reverse Engineer Wanted! Want to work with IDA and BinDiff? Want to write PoC's and Exploits? Your nationality is not important. We will get you a work permit, find an apartment, and offer a relocation compensation package. http://secunia.com/hardcore_disassembler_and_reverse_engineer/ ---------------------------------------------------------------------- TITLE: Linksys WRT54G Configuration Manipulation and Request Forgery SECUNIA ADVISORY ID: SA21372 VERIFY ADVISORY: http://secunia.com/advisories/21372/ CRITICAL: Less critical IMPACT: Hijacking, Manipulation of data WHERE: >From remote OPERATING SYSTEM: Linksys WRT54G Wireless-G Broadband Router http://secunia.com/product/3523/ DESCRIPTION: Ginsu Rabbit has reported a vulnerability and a security issue in Linksys WRT54G, which can be exploited by malicious people to conduct cross-site request forgery attacks and manipulate the configuration. disable wireless security). 2) An error exists in the web interface caused due to the device allowing users to change the router configuration via HTTP requests without performing any validity checks to verify the user's request. SOLUTION: Filter traffic to affected devices and do not visit untrusted web sites while being logged in to the device. PROVIDED AND/OR DISCOVERED BY: Ginsu Rabbit ORIGINAL ADVISORY: http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048495.html ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.79

sources: NVD: CVE-2006-5202 // CERT/CC: VU#930364 // JVNDB: JVNDB-2006-002234 // BID: 19347 // VULHUB: VHN-21310 // PACKETSTORM: 48845

AFFECTED PRODUCTS

vendor:	linksys	model:	wrt54g	scope:	eq	version:	1.00.9	Trust: 1.6
vendor:	linksys a division of cisco	model:	-	scope:	-	version:	-	Trust: 0.8
vendor:	cisco linksys	model:	wrt54g	scope:	eq	version:	1.00.9	Trust: 0.8
vendor:	linksys	model:	wrt54g	scope:	eq	version:	v1.01.0.9	Trust: 0.3
vendor:	linksys	model:	wrt54h	scope:	ne	version:	4.71.1	Trust: 0.3
vendor:	linksys	model:	wrt54g	scope:	ne	version:	v51.0.10	Trust: 0.3

sources: CERT/CC: VU#930364 // BID: 19347 // JVNDB: JVNDB-2006-002234 // CNNVD: CNNVD-200610-087 // NVD: CVE-2006-5202

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov:	CVE-2006-5202
value:	MEDIUM
Trust: 1.0
CARNEGIE MELLON:	VU#930364
value:	1.98
Trust: 0.8
NVD:	CVE-2006-5202
value:	MEDIUM
Trust: 0.8
CNNVD:	CNNVD-200610-087
value:	MEDIUM
Trust: 0.6
VULHUB:	VHN-21310
value:	MEDIUM
Trust: 0.1

nvd@nist.gov:	CVE-2006-5202
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 1.8
VULHUB:	VHN-21310
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:N/I:P/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	NONE
integrityImpact:	PARTIAL
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.1

sources: CERT/CC: VU#930364 // VULHUB: VHN-21310 // JVNDB: JVNDB-2006-002234 // CNNVD: CNNVD-200610-087 // NVD: CVE-2006-5202

PROBLEMTYPE DATA

problemtype:

NVD-CWE-Other

Trust: 1.0

sources: NVD: CVE-2006-5202

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-200610-087

TYPE

access verification error

Trust: 0.6

sources: CNNVD: CNNVD-200610-087

CONFIGURATIONS

sources: JVNDB: JVNDB-2006-002234

EXPLOIT AVAILABILITY

sources: VULHUB: VHN-21310

PATCH

title:

Linksys

url:

http://home.cisco.com/en-apac/home

Trust: 0.8

sources: JVNDB: JVNDB-2006-002234

EXTERNAL IDS

db:	CERT/CC	id:	VU#930364	Trust: 3.3
db:	SECUNIA	id:	21372	Trust: 2.6
db:	NVD	id:	CVE-2006-5202	Trust: 2.5
db:	BID	id:	19347	Trust: 2.0
db:	SECTRACK	id:	1016638	Trust: 1.7
db:	EXPLOIT-DB	id:	5926	Trust: 1.7
db:	JVNDB	id:	JVNDB-2006-002234	Trust: 0.8
db:	CNNVD	id:	CNNVD-200610-087	Trust: 0.7
db:	MILW0RM	id:	5926	Trust: 0.6
db:	FULLDISC	id:	20060804 LINKSYS WRT54G AUTHENTICATION BYPASS	Trust: 0.6
db:	VULHUB	id:	VHN-21310	Trust: 0.1
db:	PACKETSTORM	id:	48845	Trust: 0.1

sources: CERT/CC: VU#930364 // VULHUB: VHN-21310 // BID: 19347 // JVNDB: JVNDB-2006-002234 // PACKETSTORM: 48845 // CNNVD: CNNVD-200610-087 // NVD: CVE-2006-5202

REFERENCES

url:	http://lists.grok.org.uk/pipermail/full-disclosure/2006-august/048495.html	Trust: 2.6
url:	http://www.kb.cert.org/vuls/id/930364	Trust: 2.5
url:	http://www.securityfocus.com/bid/19347	Trust: 1.7
url:	https://kinqpinz.info/lib/wrt54g/	Trust: 1.7
url:	https://kinqpinz.info/lib/wrt54g/own2.txt	Trust: 1.7
url:	http://securitytracker.com/id?1016638	Trust: 1.7
url:	http://secunia.com/advisories/21372	Trust: 1.7
url:	https://www.exploit-db.com/exploits/5926	Trust: 1.1
url:	http://secunia.com/advisories/21372/	Trust: 0.9
url:	http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2006-5202	Trust: 0.8
url:	http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2006-5202	Trust: 0.8
url:	http://www.milw0rm.com/exploits/5926	Trust: 0.6
url:	http://www.linksys.com/	Trust: 0.3
url:	/archive/1/452020	Trust: 0.3
url:	http://secunia.com/secunia_security_advisories/	Trust: 0.1
url:	http://secunia.com/product/3523/	Trust: 0.1
url:	http://secunia.com/hardcore_disassembler_and_reverse_engineer/	Trust: 0.1
url:	http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org	Trust: 0.1
url:	http://secunia.com/about_secunia_advisories/	Trust: 0.1

sources: CERT/CC: VU#930364 // VULHUB: VHN-21310 // BID: 19347 // JVNDB: JVNDB-2006-002234 // PACKETSTORM: 48845 // CNNVD: CNNVD-200610-087 // NVD: CVE-2006-5202

CREDITS

Ginsu Rabbit is credited with the discovery of this vulnerability.

Trust: 0.3

sources: BID: 19347

SOURCES

db:	CERT/CC	id:	VU#930364
db:	VULHUB	id:	VHN-21310
db:	BID	id:	19347
db:	JVNDB	id:	JVNDB-2006-002234
db:	PACKETSTORM	id:	48845
db:	CNNVD	id:	CNNVD-200610-087
db:	NVD	id:	CVE-2006-5202

LAST UPDATE DATE

2025-04-10T21:33:07.450000+00:00

SOURCES UPDATE DATE

db:	CERT/CC	id:	VU#930364	date:	2006-11-21T00:00:00
db:	VULHUB	id:	VHN-21310	date:	2017-10-11T00:00:00
db:	BID	id:	19347	date:	2006-11-22T16:00:00
db:	JVNDB	id:	JVNDB-2006-002234	date:	2012-09-25T00:00:00
db:	CNNVD	id:	CNNVD-200610-087	date:	2006-10-16T00:00:00
db:	NVD	id:	CVE-2006-5202	date:	2025-04-09T00:30:58.490

SOURCES RELEASE DATE

db:	CERT/CC	id:	VU#930364	date:	2006-10-05T00:00:00
db:	VULHUB	id:	VHN-21310	date:	2006-10-10T00:00:00
db:	BID	id:	19347	date:	2006-08-04T00:00:00
db:	JVNDB	id:	JVNDB-2006-002234	date:	2012-09-25T00:00:00
db:	PACKETSTORM	id:	48845	date:	2006-08-10T00:40:54
db:	CNNVD	id:	CNNVD-200610-087	date:	2006-08-07T00:00:00
db:	NVD	id:	CVE-2006-5202	date:	2006-10-10T04:06:00