Linksys Multiple Vulnerabilities (OF, DoS, more)

critical Nessus Plugin ID 20096

Language:

Synopsis

The remote router is affected by multiple flaws.

Description

The remote host appears to be a Linksys WRT54G Wireless Router.

The firmware version installed on the remote host is prone to several flaws:

- Execute arbitrary commands on the affected router with root privilages. (CVE-2005-2916)

- Download and replace the configuration of affected routers via a special POST request to the 'restore.cgi' or 'upgrade.cgi' scripts. (CVE-2005-2799)

- Allow remote attackers to obtain encrypted configuration information and, if the key is known, modify the configuration. (CVE-2005-2914, CVE-2005-2915)

- Degrade the performance of affected devices and cause the web server to become unresponsive, potentially denying service to legitimate users. (CVE-2005-2912)

Solution

Upgrade to firmware version 4.20.7 or later.

Plugin Details

Severity: Critical

ID: 20096

File Name: linksys_multiple_vulns.nasl

Version: 1.16

Type: remote

Family: CISCO

Published: 10/28/2005

Updated: 6/12/2020

Supported Sensors: Nessus

Risk Information

VPR

Risk Factor: Medium

Score: 6.7

CVSS v2

Risk Factor: Critical

Base Score: 10

Temporal Score: 8.3

Vector: CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C

Vulnerability Information

CPE: cpe:/h:cisco:linksys_wrt54gc_router

Exploit Available: true

Exploit Ease: Exploits are available

Vulnerability Publication Date: 9/13/2005

Exploitable With

CANVAS (CANVAS)

Metasploit (Linksys WRT54GL apply.cgi Command Execution)

Reference Information

CVE: CVE-2005-2799, CVE-2005-2912, CVE-2005-2914, CVE-2005-2915, CVE-2005-2916

BID: 14822

Detections

Analytics