Back to CVE Browser

CVE-2008-1247

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1490%

EPSS Percentile19.38th

PublishedMar 10, 2008

Last ModifiedApr 23, 2026

Vulnerability Description

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri. NOTE: the Security.tri vector is already covered by CVE-2006-5202.

Affected Platforms (CPE)

🔌

Linksys

Wrt54g

All versions

References & Advisories

🔗 http://kinqpinz.info/lib/wrt54g/own.txt

🔗 http://secunia.com/advisories/29344

🔗 http://www.gnucitizen.org/projects/router-hacking-challenge/

🔗 http://www.securityfocus.com/archive/1/489009/100/0/threaded

🔗 http://www.securityfocus.com/bid/28381

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/41118

🔗 https://kinqpinz.info/lib/wrt54g/

🔗 https://kinqpinz.info/lib/wrt54g/own2.txt

Related Vulnerabilities

CVE-2008-126810.0

The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote...

CVE-2008-12657.8

The Linksys WRT54G router allows remote attackers to cause a denial of service (device restart) via a long username and password t...

CVE-2005-27997.5

Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers...

CVE-2004-26067.5

The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt t...