Sign-up

ID

VAR-202001-1158


CVE

CVE-2013-5122


TITLE

Cisco Linksys Authentication vulnerability in router

Trust: 0.8

sources: JVNDB: JVNDB-2013-007035

DESCRIPTION

Cisco Linksys Routers EA2700, EA3500, E4200, EA4500: A bug can cause an unsafe TCP port to open which leads to unauthenticated access. Cisco Linksys The router contains an authentication vulnerability.Information is acquired, information is falsified, and denial of service (DoS) May be in a state. The affected versions are as follows: Cisco Linksys EA2700 running firmware 1.0.14 Cisco Linksys EA3500 running firmware 1.0.30 Cisco Linksys EA4200 running firmware 2.0.36 Cisco Linksys EA4500 running firmware 2.0.36. Linksys E-series routers are popular router devices. Multiple Linksys E-series routers have multiple security vulnerabilities that allow malicious users to bypass some of the security restrictions: 1. The device fails to properly restrict access to tmUnblock.cgi and hndUnblock.cgi, allowing an attacker to exploit the vulnerability to inject and execute arbitrary shell commands. 2. The device fails to properly restrict access to the console, allowing an attacker to access restricted functionality through the TCP port 8083. ----------------------------------------------------------------------------- Vulnerabilities: An unspecified bug can cause an unsafe/undocumented TCP port to open allowing for: - Unauthenticated remote access to all pages of the router administration GUI, bypassing any credential prompts under certain common configurations - Direct access to several critical system files CVE-ID 2013-5122 CWE-288: Authentication Bypass Using an Alternate Path or Channel CVSS Base Score 10 CVSS Temporal Score 8.1 Exploitability Subscore: 10.0 Affected models and firmware: Linksys SMART Wi-Fi Router N600 - EA2700 Firmware Version: 1.0.14 Linksys SMART Wi-Fi Router N750 Smooth Stream EA3500 Firmware Version: 1.0.30 Linksys Maximun Performance N Router E4200v2 Firmware Version: 2.0.36 Linksys Maximun Performance N Router E4200v2 Firmware Version: 2.0.37 Linksys SMART Wi-Fi N900 Media Stream EA4500 Firmware Version: 2.0.36 Linksys SMART Wi-Fi N900 Media Stream EA4500 Firmware Version: 2.0.37 -Web Server Lighttpd 1.4.28 -Running - Linux 2.6.22 ----------------------------------------------------------------------------- Vulnerability Conditions seen in all variations, though not limited too: - Classic GUI has been enabled/installed - Remote Management - Disabled - UPnP - Enabled - IPv4 SPI Firewall Protection - Disabled Fixes and workarounds: *** It is strongly advised to those that have the classic GUI firmware installed to do a full WAN side scan for unusual ports that are open that weren't specifically opened by the end user. It is recommend to upgrade to firmware 2.1.39 on the E4200v2 and EA4500, though it is uncertain if this resolves the problem in all cases. It is recommend to upgrade to firmware 1.1.39 on the EA2700 and EA3500.though it is uncertain if this resolves the problem in all cases. Vendor: We have been working with Linksys/Belkin Engineers on this problem, and they are still investigating the root cause. We hope to have additional information on this bug soon. ----------------------------------------------------------------------------- External Links Misc: http://www.osvdb.org/show/osvdb/94768 http://www.securityfocus.com/archive/1/527027 http://securityvulns.com/news/Linksys/EA/1307.html http://www.scip.ch/en/?vuldb.9326 http://www.mobzine.ro/ionut-balan/2013/07/vulnerabilitate-majora-in-linksys-ea2700-ea3500-e4200-ea4500/ Vendor product links: http://support.linksys.com/en-us/support/routers/EA2700 http://support.linksys.com/en-us/support/routers/EA3500 http://support.linksys.com/en-us/support/routers/E4200 http://support.linksys.com/en-us/support/routers/EA4500 Discovered - 07-01-2013 Updated - 08-15-2013 Research Contact - K Lovett, M Claunch Affiliation - SUSnet . Vulnerable products : Linksys EA2700, EA3500, E4200, EA4500 Vulnerability: Due to an unknown bug, which occurs by every indication during the installation and/or upgrade process, port 8083 will often open, allowing for direct bypass of authentication to the "classic Linksys GUI" administrative console for remote unauthenticated users. If vulnerable, an attacker would have complete control of the routers administrative features and functions. On affected models by simply browsing to: http://<IP>:8083/ a user will be placed into the admin console, with no prompt for authentication. Moreover, by browsing to: http://<IP>:8083/cgi-bin/ the following four cgi scripts (often there are more depending on the firmware and model) can also be found. fw_sys_up.cgi override.cgi share_editor.cgi switch_boot.cgi It has been observed that Port 443 will show as open to external scans when the vulnerability exists, though not all routers with this open port are affected. On the http header for port 8083, for those affected, "Basic Setup" is the only item of note observed. An end user should not rely on the router's GUI interface for the status of remote access, as this bug is present when the console shows remote access as disabled. CVE ID: 2013-5122 CWE-288: Authentication Bypass Using an Alternate Path or Channel CVSS Base Score 10 CVSS Temporal Score 8.1 Exploitability Subscore: 10.0 Timeline: The vendor was first notified of this bug in July 2013, and several follow-up conversations have occurred since that time. Patches/Workaround: No known patches or official fixes exist, though some workaround fixes, including reinstallation of the firmware have been often shown to solve the issue. This is not an official workaround and it is strongly advised to contact Linksys support for additional information. Recommendations: - Scan for an open port 8083 from the WAN side of the router to check for this particular vulnerability. - Since an attacker has access to enable FTP service, USB drives mounted on those routers which have them, should be removed until an official fix is out or vulnerability of the router has been ruled out. Research Contacts: Kyle Lovett and Matt Claunch Discovered - July 2013 Updated - February 2014

Trust: 3.15

sources: NVD: CVE-2013-5122 // JVNDB: JVNDB-2013-007035 // CNVD: CNVD-2013-08724 // CNVD: CNVD-2014-01260 // BID: 60897 // PACKETSTORM: 122841 // PACKETSTORM: 125242

IOT TAXONOMY

category:['Network device']sub_category: -

Trust: 1.2

sources: CNVD: CNVD-2013-08724 // CNVD: CNVD-2014-01260

AFFECTED PRODUCTS

vendor:ciscomodel:linksys e4200scope: - version: -

Trust: 1.2

vendor:ciscomodel:linksys ea4500scope: - version: -

Trust: 1.2

vendor:ciscomodel:linksys ea3500scope: - version: -

Trust: 1.2

vendor:ciscomodel:linksys ea2700scope: - version: -

Trust: 1.2

vendor:ciscomodel:linksys ea3500scope:eqversion:1.0.30

Trust: 1.0

vendor:ciscomodel:linksys ea4500scope:eqversion:2.0.36

Trust: 1.0

vendor:ciscomodel:linksys e4200scope:eqversion:2.0.36

Trust: 1.0

vendor:ciscomodel:linksys ea2700scope:eqversion:1.0.14

Trust: 1.0

vendor:ciscomodel:linksys e 4200scope: - version: -

Trust: 0.8

vendor:ciscomodel:linksys ea 2700scope: - version: -

Trust: 0.8

vendor:ciscomodel:linksys ea 3500scope: - version: -

Trust: 0.8

vendor:ciscomodel:linksys ea 4500scope: - version: -

Trust: 0.8

vendor:ciscomodel:linksys e1000scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e2100lscope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e1500scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e2500scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e2500 buildscope:eqversion:1.0.034

Trust: 0.6

vendor:ciscomodel:linksys e1550scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e1200scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e3200scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e3000scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e2000scope: - version: -

Trust: 0.6

vendor:ciscomodel:linksys e900scope: - version: -

Trust: 0.6

sources: CNVD: CNVD-2013-08724 // CNVD: CNVD-2014-01260 // JVNDB: JVNDB-2013-007035 // NVD: CVE-2013-5122

CVSS

SEVERITY

CVSSV2

CVSSV3

nvd@nist.gov: CVE-2013-5122
value: CRITICAL

Trust: 1.0

NVD: CVE-2013-5122
value: CRITICAL

Trust: 0.8

CNVD: CNVD-2013-08724
value: MEDIUM

Trust: 0.6

CNVD: CNVD-2014-01260
value: HIGH

Trust: 0.6

CNNVD: CNNVD-201307-283
value: CRITICAL

Trust: 0.6

nvd@nist.gov: CVE-2013-5122
severity: HIGH
baseScore: 10.0
vectorString: AV:N/AC:L/AU:N/C:C/I:C/A:C
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: COMPLETE
integrityImpact: COMPLETE
availabilityImpact: COMPLETE
exploitabilityScore: 10.0
impactScore: 10.0
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 1.8

CNVD: CNVD-2013-08724
severity: MEDIUM
baseScore: 5.0
vectorString: AV:N/AC:L/AU:N/C:P/I:N/A:N
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: NONE
availabilityImpact: NONE
exploitabilityScore: 10.0
impactScore: 2.9
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

CNVD: CNVD-2014-01260
severity: HIGH
baseScore: 7.5
vectorString: AV:N/AC:L/AU:N/C:P/I:P/A:P
accessVector: NETWORK
accessComplexity: LOW
authentication: NONE
confidentialityImpact: PARTIAL
integrityImpact: PARTIAL
availabilityImpact: PARTIAL
exploitabilityScore: 10.0
impactScore: 6.4
acInsufInfo: NONE
obtainAllPrivilege: NONE
obtainUserPrivilege: NONE
obtainOtherPrivilege: NONE
userInteractionRequired: NONE
version: 2.0

Trust: 0.6

nvd@nist.gov: CVE-2013-5122
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: 3.9
impactScore: 5.9
version: 3.1

Trust: 1.0

NVD: CVE-2013-5122
baseSeverity: CRITICAL
baseScore: 9.8
vectorString: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
attackVector: NETWORK
attackComplexity: LOW
privilegesRequired: NONE
userInteraction: NONE
scope: UNCHANGED
confidentialityImpact: HIGH
integrityImpact: HIGH
availabilityImpact: HIGH
exploitabilityScore: NONE
impactScore: NONE
version: 3.0

Trust: 0.8

sources: CNVD: CNVD-2013-08724 // CNVD: CNVD-2014-01260 // JVNDB: JVNDB-2013-007035 // CNNVD: CNNVD-201307-283 // NVD: CVE-2013-5122

PROBLEMTYPE DATA

problemtype:CWE-287

Trust: 1.8

sources: JVNDB: JVNDB-2013-007035 // NVD: CVE-2013-5122

THREAT TYPE

remote

Trust: 0.7

sources: PACKETSTORM: 122841 // CNNVD: CNNVD-201307-283

TYPE

authorization issue

Trust: 0.6

sources: CNNVD: CNNVD-201307-283

CONFIGURATIONS

sources:
            
            
            JVNDB: JVNDB-2013-007035

PATCH
title:Top Pageurl:https://www.cisco.com/
Trust: 0.8
sources:
            
            
            JVNDB: JVNDB-2013-007035

EXTERNAL IDS
db:BIDid:60897
Trust: 3.3
db:NVDid:CVE-2013-5122
Trust: 2.9
db:SECTRACKid:1029769
Trust: 1.6
db:JVNDBid:JVNDB-2013-007035
Trust: 0.8
db:PACKETSTORMid:125242
Trust: 0.7
db:CNVDid:CNVD-2013-08724
Trust: 0.6
db:EXPLOITDBid:31683
Trust: 0.6
db:OSVDBid:103321
Trust: 0.6
db:EXPLOIT-DBid:31683
Trust: 0.6
db:CNVDid:CNVD-2014-01260
Trust: 0.6
db:CNNVDid:CNNVD-201307-283
Trust: 0.6
db:VULDBid:9326
Trust: 0.1
db:OSVDBid:94768
Trust: 0.1
db:PACKETSTORMid:122841
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-08724 // 
            
            
            
            CNVD: CNVD-2014-01260 // 
            
            
            
            BID: 60897 // 
            
            
            
            JVNDB: JVNDB-2013-007035 // 
            
            
            
            PACKETSTORM: 122841 // 
            
            
            
            PACKETSTORM: 125242 // 
            
            
            
            CNNVD: CNNVD-201307-283 // 
            
            
            
            NVD: CVE-2013-5122

REFERENCES
url:http://www.securityfocus.com/bid/60897
Trust: 3.0
url:https://nvd.nist.gov/vuln/detail/cve-2013-5122
Trust: 1.6
url:https://packetstormsecurity.com/files/cve/cve-2013-5122
Trust: 1.6
url:http://www.securitytracker.com/id/1029769
Trust: 1.6
url:https://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2013-5122
Trust: 0.8
url:http://osvdb.org/show/osvdb/103321
Trust: 0.6
url:http://www.exploit-db.com/exploits/31683/
Trust: 0.6
url:http://www.reddit.com/r/netsec/comments/1xy9k6/that_new_linksys_worm/
Trust: 0.6
url:http://packetstormsecurity.com/files/125242/linksys-ea2700-ea3500-e4200-ea4500-authentication-bypass.html
Trust: 0.6
url:http://www.cisco.com/
Trust: 0.3
url:http://support.linksys.com/en-us/support/routers/ea2700
Trust: 0.1
url:http://support.linksys.com/en-us/support/routers/e4200
Trust: 0.1
url:http://securityvulns.com/news/linksys/ea/1307.html
Trust: 0.1
url:http://www.scip.ch/en/?vuldb.9326
Trust: 0.1
url:http://www.osvdb.org/show/osvdb/94768
Trust: 0.1
url:http://support.linksys.com/en-us/support/routers/ea4500
Trust: 0.1
url:http://support.linksys.com/en-us/support/routers/ea3500
Trust: 0.1
url:http://www.securityfocus.com/archive/1/527027
Trust: 0.1
url:http://www.mobzine.ro/ionut-balan/2013/07/vulnerabilitate-majora-in-linksys-ea2700-ea3500-e4200-ea4500/
Trust: 0.1
url:http://<ip>:8083/cgi-bin/
Trust: 0.1
url:http://<ip>:8083/
Trust: 0.1
sources:
            
            
            CNVD: CNVD-2013-08724 // 
            
            
            
            CNVD: CNVD-2014-01260 // 
            
            
            
            BID: 60897 // 
            
            
            
            JVNDB: JVNDB-2013-007035 // 
            
            
            
            PACKETSTORM: 122841 // 
            
            
            
            PACKETSTORM: 125242 // 
            
            
            
            CNNVD: CNNVD-201307-283 // 
            
            
            
            NVD: CVE-2013-5122

CREDITS
kyle Lovett
Trust: 1.0
sources:
            
            
            BID: 60897 // 
            
            
            
            PACKETSTORM: 122841 // 
            
            
            
            CNNVD: CNNVD-201307-283

SOURCES
db:CNVDid:CNVD-2013-08724
db:CNVDid:CNVD-2014-01260
db:BIDid:60897
db:JVNDBid:JVNDB-2013-007035
db:PACKETSTORMid:122841
db:PACKETSTORMid:125242
db:CNNVDid:CNNVD-201307-283
db:NVDid:CVE-2013-5122

LAST UPDATE DATE
2024-11-23T22:29:47.792000+00:00

SOURCES UPDATE DATE
db:CNVDid:CNVD-2013-08724date:2013-07-04T00:00:00
db:CNVDid:CNVD-2014-01260date:2015-08-04T00:00:00
db:BIDid:60897date:2013-08-19T10:17:00
db:JVNDBid:JVNDB-2013-007035date:2020-01-22T00:00:00
db:CNNVDid:CNNVD-201307-283date:2020-01-17T00:00:00
db:NVDid:CVE-2013-5122date:2024-11-21T01:57:03.663

SOURCES RELEASE DATE
db:CNVDid:CNVD-2013-08724date:2013-07-04T00:00:00
db:CNVDid:CNVD-2014-01260date:2014-02-26T00:00:00
db:BIDid:60897date:2013-07-02T00:00:00
db:JVNDBid:JVNDB-2013-007035date:2020-01-22T00:00:00
db:PACKETSTORMid:122841date:2013-08-15T12:12:12
db:PACKETSTORMid:125242date:2014-02-17T10:44:44
db:CNNVDid:CNNVD-201307-283date:2013-07-17T00:00:00
db:NVDid:CVE-2013-5122date:2020-01-07T14:15:10.077