Sign-up

ID

VAR-201006-0273


CVE

CVE-2010-1573


TITLE

Linksys WAP54Gv3 firmware web page debugging interface trust management vulnerability

Trust: 1.2

sources: CNVD: CNVD-2010-4298 // CNNVD: CNNVD-201006-122

DESCRIPTION

Linksys WAP54Gv3 firmware 3.04.03 and earlier uses a hard-coded username (Gemtek) and password (gemtekswd) for a debug interface for certain web pages, which allows remote attackers to execute arbitrary commands via the (1) data1, (2) data2, or (3) data3 parameters to (a) Debug_command_page.asp and (b) debug.cgi. (1) Debug_command_page.asp and debug.cgi to data1 parameters (2) Debug_command_page.asp and debug.cgi to data2 parameters (3) Debug_command_page.asp and debug.cgi to data3 parameters. Successful attacks allow an attacker to gain access to the device. Linksys WAP54Gv3 wireless router devices are prone to a security-bypass vulnerability because they allow access to debugging scripts through hard coded credentials. The following firmware versions are vulnerable: 3.05.03 (Europe) 3.04.03 (US) Other versions or devices may also be affected. ---------------------------------------------------------------------- Secunia CSI integrated with Microsoft WSUS and Microsoft SCCM for 3rd party Patch Management Free webinars http://secunia.com/vulnerability_scanning/corporate/webinars/ ---------------------------------------------------------------------- TITLE: Linksys WAP54G Undocumented Debug Interface Vulnerability SECUNIA ADVISORY ID: SA40103 VERIFY ADVISORY: Secunia.com http://secunia.com/advisories/40103/ Customer Area (Credentials Required) https://ca.secunia.com/?page=viewadvisory&vuln_id=40103 RELEASE DATE: 2010-06-10 DISCUSS ADVISORY: http://secunia.com/advisories/40103/#comments AVAILABLE ON SITE AND IN CUSTOMER AREA: * Last Update * Popularity * Comments * Criticality Level * Impact * Where * Solution Status * Operating System / Software * CVE Reference(s) http://secunia.com/advisories/40103/ ONLY AVAILABLE IN CUSTOMER AREA: * Authentication Level * Report Reliability * Secunia PoC * Secunia Analysis * Systems Affected * Approve Distribution * Remediation Status * Secunia CVSS Score * CVSS https://ca.secunia.com/?page=viewadvisory&vuln_id=40103 ONLY AVAILABLE WITH SECUNIA CSI AND SECUNIA PSI: * AUTOMATED SCANNING http://secunia.com/vulnerability_scanning/personal/ http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/ DESCRIPTION: Cristofaro Mune has reported a vulnerability in Linksys WAP54G, which can be exploited by malicious people to compromise a vulnerable device. The vulnerability is caused due to the device containing the undocumented "Debug_command_page.asp" and "debug.cgi" debug scripts. This can be exploited to e.g. gain root access by accessing the debug scripts using hard-coded credentials. The vulnerability is reported in version 3.05.03 and 3.04.03. Note: Reportedly, this only affects devices running a firmware approved for EMEA (Europe, Middle East, and Africa). SOLUTION: Restrict access using a proxy or firewall. PROVIDED AND/OR DISCOVERED BY: Cristofaro Mune ORIGINAL ADVISORY: http://www.icysilence.org/?p=268 OTHER REFERENCES: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ DEEP LINKS: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED DESCRIPTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXTENDED SOLUTION: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ EXPLOIT: Further details available in Customer Area: http://secunia.com/products/corporate/EVM/ ---------------------------------------------------------------------- About: This Advisory was delivered by Secunia as a free service to help private users keeping their systems up to date against the latest vulnerabilities. Subscribe: http://secunia.com/advisories/secunia_security_advisories/ Definitions: (Criticality, Where etc.) http://secunia.com/advisories/about_secunia_advisories/ Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor. ---------------------------------------------------------------------- Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org ----------------------------------------------------------------------

Trust: 2.61

sources: NVD: CVE-2010-1573 // JVNDB: JVNDB-2010-004711 // CNVD: CNVD-2010-4298 // BID: 40648 // VULHUB: VHN-44178 // PACKETSTORM: 90483

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 0.6

sources: CNVD: CNVD-2010-4298

AFFECTED PRODUCTS

vendor:linksysmodel:wap54gscope:lteversion:3.04.03

Trust: 1.0

vendor:linksysmodel:wap54gv3scope:eqversion:3.5.3

Trust: 0.9

vendor:linksysmodel:wap54gv3scope:eqversion:3.4.3

Trust: 0.9

vendor:シスコシステムズ linksysmodel:wap54gv3scope:eqversion: -

Trust: 0.8

vendor:シスコシステムズ linksysmodel:wap54gv3scope:lteversion:3.04.03 and earlier

Trust: 0.8

vendor:linksysmodel:wap54gv3scope:eqversion:3.05.03

Trust: 0.6

vendor:linksysmodel:wap54gv3scope:eqversion:3.04.03

Trust: 0.6

sources: CNVD: CNVD-2010-4298 // BID: 40648 // JVNDB: JVNDB-2010-004711 // CNNVD: CNNVD-201006-122 // NVD: CVE-2010-1573

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2010-1573
value: CRITICAL

Trust: 1.0

NVD: CVE-2010-1573
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2010-4298
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201006-122
value: CRITICAL

Trust: 0.6

VULHUB: VHN-44178
value: HIGH

Trust: 0.1

nvd@nist.gov: CVE-2010-1573
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2010-4298
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

VULHUB: VHN-44178
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.1

nvd@nist.gov: CVE-2010-1573
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2010-1573
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2010-4298 // VULHUB: VHN-44178 // JVNDB: JVNDB-2010-004711 // CNNVD: CNNVD-201006-122 // NVD: CVE-2010-1573

PROBLEMTYPE DATA

problemtype:CWE-798

Trust: 1.0

problemtype:Use hard-coded credentials (CWE-798) [NVD evaluation ]

Trust: 0.8

problemtype:CWE-255

Trust: 0.1

sources: VULHUB: VHN-44178 // JVNDB: JVNDB-2010-004711 // NVD: CVE-2010-1573

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201006-122

TYPE

trust management

Trust: 0.6

sources: CNNVD: CNNVD-201006-122

PATCH

title:Linksysurl:http://home.cisco.com/en-apac/home

Trust: 0.8

sources: JVNDB: JVNDB-2010-004711

EXTERNAL IDS

db:NVDid:CVE-2010-1573

Trust: 4.2

db:BIDid:40648

Trust: 2.6

db:SECUNIAid:40103

Trust: 1.2

db:VUPENid:ADV-2010-1419

Trust: 1.1

db:JVNDBid:JVNDB-2010-004711

Trust: 0.8

db:CNNVDid:CNNVD-201006-122

Trust: 0.7

db:CNVDid:CNVD-2010-4298

Trust: 0.6

db:BUGTRAQid:20100608 IS-2010-002 - LINKSYS WAP54GV3 REMOTE DEBUG ROOT SHELL

Trust: 0.6

db:VULHUBid:VHN-44178

Trust: 0.1

db:PACKETSTORMid:90483

Trust: 0.1

sources: CNVD: CNVD-2010-4298 // VULHUB: VHN-44178 // BID: 40648 // JVNDB: JVNDB-2010-004711 // PACKETSTORM: 90483 // CNNVD: CNNVD-201006-122 // NVD: CVE-2010-1573

REFERENCES

url:http://www.icysilence.org/?p=268

Trust: 2.1

url:http://www.securityfocus.com/bid/40648

Trust: 1.7

url:http://tools.cisco.com/security/center/viewalert.x?alertid=20682

Trust: 1.7

url:http://www.securityfocus.com/archive/1/511733/100/0/threaded

Trust: 1.1

url:http://secunia.com/advisories/40103

Trust: 1.1

url:http://www.vupen.com/english/advisories/2010/1419

Trust: 1.1

url:https://exchange.xforce.ibmcloud.com/vulnerabilities/59286

Trust: 1.1

url:http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2010-1573

Trust: 0.8

url:http://www.securityfocus.com/bid/40648/info

Trust: 0.6

url:http://www.securityfocus.com/archive/1/archive/1/511733/100/0/threaded

Trust: 0.6

url:http://www.linksys.com/

Trust: 0.3

url:/archive/1/511733

Trust: 0.3

url:http://secunia.com/products/corporate/evm/

Trust: 0.1

url:http://secunia.com/advisories/secunia_security_advisories/

Trust: 0.1

url:http://secunia.com/vulnerability_scanning/corporate/wsus_sccm_3rd_third_party_patching/

Trust: 0.1

url:http://secunia.com/advisories/40103/

Trust: 0.1

url:http://secunia.com/advisories/40103/#comments

Trust: 0.1

url:http://secunia.com/vulnerability_scanning/corporate/webinars/

Trust: 0.1

url:http://secunia.com/vulnerability_scanning/personal/

Trust: 0.1

url:http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org

Trust: 0.1

url:https://ca.secunia.com/?page=viewadvisory&vuln_id=40103

Trust: 0.1

url:http://secunia.com/advisories/about_secunia_advisories/

Trust: 0.1

sources: CNVD: CNVD-2010-4298 // VULHUB: VHN-44178 // BID: 40648 // JVNDB: JVNDB-2010-004711 // PACKETSTORM: 90483 // CNNVD: CNNVD-201006-122 // NVD: CVE-2010-1573

CREDITS

Cristofaro Mune

Trust: 0.3

sources: BID: 40648

SOURCES

db:CNVDid:CNVD-2010-4298
db:VULHUBid:VHN-44178
db:BIDid:40648
db:JVNDBid:JVNDB-2010-004711
db:PACKETSTORMid:90483
db:CNNVDid:CNNVD-201006-122
db:NVDid:CVE-2010-1573

LAST UPDATE DATE

2025-04-11T23:14:59.390000+00:00


SOURCES UPDATE DATE

db:CNVDid:CNVD-2010-4298date:2010-06-13T00:00:00
db:VULHUBid:VHN-44178date:2018-10-10T00:00:00
db:BIDid:40648date:2015-04-13T21:02:00
db:JVNDBid:JVNDB-2010-004711date:2024-03-01T03:46:00
db:CNNVDid:CNNVD-201006-122date:2010-06-13T00:00:00
db:NVDid:CVE-2010-1573date:2025-04-11T00:51:21.963

SOURCES RELEASE DATE

db:CNVDid:CNVD-2010-4298date:2010-06-13T00:00:00
db:VULHUBid:VHN-44178date:2010-06-10T00:00:00
db:BIDid:40648date:2010-06-08T00:00:00
db:JVNDBid:JVNDB-2010-004711date:2012-09-25T00:00:00
db:PACKETSTORMid:90483date:2010-06-11T13:54:04
db:CNNVDid:CNNVD-201006-122date:2010-06-13T00:00:00
db:NVDid:CVE-2010-1573date:2010-06-10T00:30:07.503