返回 CVE 浏览器

CVE-2008-1247

CRITICAL

10.0

CVSS Severity Score

EPSS Score0.1490%

EPSS Percentile19.38th

Published2008年3月10日

Last Modified2026年4月23日

Vulnerability Description

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri. NOTE: the Security.tri vector is already covered by CVE-2006-5202.

Affected Platforms (CPE)

🔌

Linksys

Wrt54g

All versions

References & Advisories

🔗 http://kinqpinz.info/lib/wrt54g/own.txt

🔗 http://secunia.com/advisories/29344

🔗 http://www.gnucitizen.org/projects/router-hacking-challenge/

🔗 http://www.securityfocus.com/archive/1/489009/100/0/threaded

🔗 http://www.securityfocus.com/bid/28381

🔗 https://exchange.xforce.ibmcloud.com/vulnerabilities/41118

🔗 https://kinqpinz.info/lib/wrt54g/

🔗 https://kinqpinz.info/lib/wrt54g/own2.txt

相关漏洞威胁

CVE-2008-126810.0

The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote...

CVE-2008-12657.8

The Linksys WRT54G router allows remote attackers to cause a denial of service (device restart) via a long username and password t...

CVE-2005-27997.5

Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers...

CVE-2004-26067.5

The Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt t...