Cross-Site Scripting Vulnerabilities in Linksys Wireless-G ADSL Gateway

vendor:

Linksys Wireless-G ADSL Gateway

by:

Unknown

7.5

CVSS

HIGH

Cross-Site Scripting

CWE

Product Name: Linksys Wireless-G ADSL Gateway

Affected Version From: Linksys Wireless-G ADSL Gateway WAG54GS running firmware V1.00.06

Affected Version To: Unknown

Patch Exists: NO

Related CWE:

CPE: h:cisco:linksys_wag54gs_firmware:v1.00.06

Metasploit:

Other Scripts:

Platforms Tested:

Unknown

Cross-Site Scripting Vulnerabilities in Linksys Wireless-G ADSL Gateway

The Linksys Wireless-G ADSL Gateway is prone to multiple cross-site scripting vulnerabilities due to inadequate input sanitization. Attackers can exploit this by enticing victims to open a malicious URI. This can lead to the execution of arbitrary script code in the user's browser within the context of the affected device. The attacker can then steal authentication credentials, cause denial-of-service conditions, and launch further attacks. Successful exploits allow persistent storage of script code in the affected device.

Mitigation:

There is no specific mitigation information available for this vulnerability.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/24682/info

Linksys Wireless-G ADSL Gateway is prone to multiple cross-site scripting vulnerabilities because the application fails to properly sanitize user-supplied input.

Attackers may exploit this issue by enticing victims into opening a malicious URI.

An attacker may leverage this issue to execute arbitrary script code in the browser of an unsuspecting user in the context of the affected device. This may help the attacker steal cookie-based authentication credentials, cause denial-of-service conditions, and launch other attacks.

Successful exploits will allow script code to be stored persistently in the affected device.

Linksys Wireless-G ADSL Gateway WAG54GS running firmware V1.00.06 is reported vulnerable. 

http://admin:admin@192.168.1.1/setup.cgi?user_list=1&sysname=admin& sysPasswd=admin&sysConfirmPasswd=admin&remote_management=enable&http _wanport=8080&devname=&snmp_enable=disable&upnp_enable=enable&wlan_e nable=enable&save=Save+Settings&h_user_list=1&h_pwset=yes&pwchanged= yes&h_remote_management=enable&c4_trap_ip_=">