VULHUB ™

iDEFENSE Security Advisory 09.13.05 - Remote exploitation of a design error in multiple versions of the firmware for Cisco Systems Inc.'s Linksys WRT54G wireless router may allow unauthenticated modification of the router configuration. The vulnerability specifically exists in the 'ezconfig.asp' handler of the httpd running on the internal interfaces, including by default the wireless interface. This handler is used by the 'ezSetup' to perform the initial setup of the router. iDEFENSE has confirmed the existence of this vulnerability in version 3.01.03 of the firmware of the Linksys WRT54G, and has identified the same code is present in version 3.03.6. Version 2.04.4 of the WRT54G is confirmed to contain the affected code, however by default it initializes the authentication details, and so requires a password to set the configuration.

iDEFENSE Security Advisory 09.13.05 - Remote exploitation of a design error in multiple versions of the firmware for Cisco Systems Inc.'s Linksys WRT54G wireless router may allow unauthenticated modification of the router configuration. The vulnerability specifically exists in the 'ezconfig.asp' handler of the httpd running on the internal interfaces, including by default the wireless interface. This handler is used by the 'ezSetup' to perform the initial setup of the router. iDEFENSE has confirmed the existence of this vulnerability in version 3.01.03 of the firmware of the Linksys WRT54G, and has identified the same code is present in version 3.03.6. Version 2.04.4 of the WRT54G is confirmed to contain the affected code, however by default it initializes the authentication details, and so requires a password to set the configuration.