Description
Linksys WRT54g firmware 1.00.9 does not require credentials when making configuration changes, which allows remote attackers to modify arbitrary configurations via a direct request to Security.tri, as demonstrated using the SecurityMode and layout parameters, a different issue than CVE-2006-2559.
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Exploit-DB 1
- Linksys WRT54G Firmware 1.00.9 - Security Bypass (2) EDB-5926 · remote · Jun 24, 2008 · verified
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- 19347 vdb-entry
- https://kinqpinz.info/lib/wrt54g/
- 20060804 linksys WRT54g authentication bypass mailing-list
- 5926 exploit
- https://kinqpinz.info/lib/wrt54g/own2.txt
- VU#930364 third-party-advisory
- 21372 third-party-advisory
- 1016638 vdb-entry