Description
Buffer overflow in apply.cgi in Linksys WRT54G 3.01.03, 3.03.6, and possibly other versions before 4.20.7, allows remote attackers to execute arbitrary code via a long HTTP POST request.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 2 modules
-
Linksys WRT54 Access Point apply.cgi Buffer Overflow
exploit/linux/http/linksys_apply_cgi
-
Linksys WRT54GL apply.cgi Command Execution
exploit/linux/http/linksys_wrt54gl_apply_exec
Exploit-DB 2
- Linksys WRT54 Access Point - 'apply.cgi' Remote Buffer Overflow (Metasploit) EDB-16854 · remote · Sep 24, 2010 · verified
- Linksys WRT54G < 4.20.7 / WRT54GS < 1.05.2 - 'apply.cgi' Remote Buffer Overflow (Metasploit) EDB-10028 · remote · Sep 13, 2005 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.