Description
Multiple cross-site request forgery (CSRF) vulnerabilities on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.01.03 and earlier firmware allow remote attackers to perform actions as administrators via an arbitrary valid request to an administrative URI, as demonstrated by (1) a Restore Factory Defaults action using the mtenRestore parameter to setup.cgi and (2) creation of a user account using the sysname parameter to setup.cgi.
References
- 20080301 The Router Hacking Challenge is Over! mailing-list
- http://www.gnucitizen.org/projects/router-hacking-challenge/
- 43537 vdb-entry
- http://www.gnucitizen.org/blog/persistent-xss-and-csrf-on-wireless-g-adsl-gateway-with-speedbooster-wag54gs/
- linksys-wag54gs-setup-csfr(41269) vdb-entry
- 43538 vdb-entry