Details of VAR-201304-0455

ID

VAR-201304-0455

TITLE

Linksys EA2700 Source Code Disclosure Vulnerability

Trust: 0.6

sources: CNVD: CNVD-2013-03129

DESCRIPTION

The Cisco Linksys EA2700 incorrectly handles the '/' character contained in the URL, allowing authenticated attackers to exploit malicious exploits to submit CGI source code information. The Cisco Linksys EA2700 is a smart wireless router. The following security vulnerabilities exist in the Cisco Linksys EA2700 router version 1.0.12.128947: 1. Security bypass vulnerability 2. Cross-site request forgery vulnerability 3. Cross-site scripting vulnerability. Attackers can use these vulnerabilities to bypass specific security restrictions, steal cookie-based authentication certificates, gain access to systems and other configuration files, or perform unauthorized operations in the context of a user's session

Trust: 1.35

sources: CNVD: CNVD-2013-03129 // CNNVD: CNNVD-201304-220 // BID: 59054

IOT TAXONOMY

category:

['Network device']

sub_category:

Trust: 0.6

sources: CNVD: CNVD-2013-03129

AFFECTED PRODUCTS

vendor:

cisco

model:

ea2700

scope:

version:

Trust: 0.6

sources: CNVD: CNVD-2013-03129

CVSS

SEVERITY

CVSSV2

CVSSV3

CNVD:	CNVD-2013-03129
value:	MEDIUM
Trust: 0.6

CNVD:	CNVD-2013-03129
severity:	MEDIUM
baseScore:	5.0
vectorString:	AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector:	NETWORK
accessComplexity:	LOW
authentication:	NONE
confidentialityImpact:	PARTIAL
integrityImpact:	NONE
availabilityImpact:	NONE
exploitabilityScore:	10.0
impactScore:	2.9
acInsufInfo:	NONE
obtainAllPrivilege:	NONE
obtainUserPrivilege:	NONE
obtainOtherPrivilege:	NONE
userInteractionRequired:	NONE
version:	2.0
Trust: 0.6

sources: CNVD: CNVD-2013-03129

THREAT TYPE

remote

Trust: 0.6

sources: CNNVD: CNNVD-201304-220

TYPE

Input Validation Error

Trust: 0.3

sources: BID: 59054

EXTERNAL IDS

db:	BID	id:	59054	Trust: 1.5
db:	CNVD	id:	CNVD-2013-03129	Trust: 0.6
db:	CNNVD	id:	CNNVD-201304-220	Trust: 0.6

sources: CNVD: CNVD-2013-03129 // BID: 59054 // CNNVD: CNNVD-201304-220

REFERENCES

url:	http://arstechnica.com/security/2013/04/using-a-linksys-wi-fi-router-it-could-be-ripe-for-remote-takeover/	Trust: 0.6
url:	https://superevr.com/blog/2013/dont-use-linksys-routers/	Trust: 0.6
url:	http://www.securityfocus.com/bid/59054	Trust: 0.6

sources: CNVD: CNVD-2013-03129 // CNNVD: CNNVD-201304-220

CREDITS

Phil Purviance

Trust: 0.9

sources: BID: 59054 // CNNVD: CNNVD-201304-220

SOURCES

db:	CNVD	id:	CNVD-2013-03129
db:	BID	id:	59054
db:	CNNVD	id:	CNNVD-201304-220

LAST UPDATE DATE

2022-05-17T01:53:14.020000+00:00

SOURCES UPDATE DATE

db:	CNVD	id:	CNVD-2013-03129	date:	2013-05-28T00:00:00
db:	BID	id:	59054	date:	2013-04-15T00:00:00
db:	CNNVD	id:	CNNVD-201304-220	date:	2013-04-16T00:00:00

SOURCES RELEASE DATE

db:	CNVD	id:	CNVD-2013-03129	date:	2013-04-16T00:00:00
db:	BID	id:	59054	date:	2013-04-15T00:00:00
db:	CNNVD	id:	CNNVD-201304-220	date:	2013-04-16T00:00:00