Description
A directory traversal vulnerability exists in Linksys router's web interface (tested on the E1500 model firmware versions 1.0.00, 1.0.04, and 1.0.05), specifically in the /apply.cgi endpoint. Authenticated attackers can exploit the next_page POST parameter to access arbitrary files outside the intended web root by injecting traversal sequences. This allows exposure of sensitive system files and configuration data.
Affected products
| Vendor | Product | Affected | Fixed |
|---|---|---|---|
| Linksys | E1500 | 1.0.00, 1.0.04, 1.0.05 | — |
Public exploits
Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.
Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.
Metasploit 1 module
-
Linksys E1500 Directory Traversal Vulnerability
auxiliary/scanner/http/linksys_e1500_traversal
Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.
References
- https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/auxiliary/scanner/http/linksys_e1500_traversal.rb exploit
- https://www.exploit-db.com/exploits/24475 exploit
- https://web.archive.org/web/20150428184015/http://www.s3cur1ty.de/m1adv2013-004 technical-description exploit
- https://www.vulncheck.com/advisories/linksys-legacy-routers-path-traversal third-party-advisory