exploit the possibilities

Linksys EA2700, EA3500, E4200, EA4500 Authentication Bypass

Linksys EA2700, EA3500, E4200, EA4500 Authentication Bypass
Posted Feb 17, 2014
Authored by Kyle Lovett, Matt Claunch

Linksys products EA2700, EA3500, E4200, and EA4500 suffer from having an unauthenticated interface on port 8083 periodically.

tags | advisory
advisories | CVE-2013-5122
MD5 | 14e65fc1b6fb02790688636e83743de0

Linksys EA2700, EA3500, E4200, EA4500 Authentication Bypass

Change Mirror Download
Vulnerable products : Linksys EA2700, EA3500, E4200, EA4500

Vulnerability:
Due to an unknown bug, which occurs by every indication during the
installation and/or upgrade process, port 8083 will often open,
allowing for direct bypass of authentication to the "classic Linksys
GUI" administrative console for remote unauthenticated users.

If vulnerable, an attacker would have complete control of the routers
administrative features and functions.

On affected models by simply browsing to:

http://<IP>:8083/

a user will be placed into the admin console, with no prompt for
authentication. Moreover, by browsing to:

http://<IP>:8083/cgi-bin/

the following four cgi scripts (often there are more depending on the
firmware and model) can also be found.

fw_sys_up.cgi
override.cgi
share_editor.cgi
switch_boot.cgi

It has been observed that Port 443 will show as open to external scans
when the vulnerability exists, though not all routers with this open
port are affected. On the http header for port 8083, for those
affected, "Basic Setup" is the only item of note observed.

An end user should not rely on the router's GUI interface for the
status of remote access, as this bug is present when the console shows
remote access as disabled.

CVE ID: 2013-5122
CWE-288: Authentication Bypass Using an Alternate Path or Channel
CVSS Base Score 10
CVSS Temporal Score 8.1
Exploitability Subscore: 10.0

Timeline:
The vendor was first notified of this bug in July 2013, and several
follow-up conversations have occurred since that time.

Patches/Workaround:
No known patches or official fixes exist, though some workaround
fixes, including reinstallation of the firmware have been often shown
to solve the issue. This is not an official workaround and it is
strongly advised to contact Linksys support for additional
information.

Recommendations:

- Scan for an open port 8083 from the WAN side of the router to check
for this particular vulnerability.
- Since an attacker has access to enable FTP service, USB drives
mounted on those routers which have them, should be removed until an
official fix is out or vulnerability of the router has been ruled out.

Research Contacts: Kyle Lovett and Matt Claunch
Discovered - July 2013
Updated - February 2014
Login or Register to add favorites

File Archive:

January 2021

  • Su
  • Mo
  • Tu
  • We
  • Th
  • Fr
  • Sa
  • 1
    Jan 1st
    4 Files
  • 2
    Jan 2nd
    3 Files
  • 3
    Jan 3rd
    3 Files
  • 4
    Jan 4th
    33 Files
  • 5
    Jan 5th
    31 Files
  • 6
    Jan 6th
    21 Files
  • 7
    Jan 7th
    15 Files
  • 8
    Jan 8th
    19 Files
  • 9
    Jan 9th
    1 Files
  • 10
    Jan 10th
    1 Files
  • 11
    Jan 11th
    33 Files
  • 12
    Jan 12th
    19 Files
  • 13
    Jan 13th
    27 Files
  • 14
    Jan 14th
    8 Files
  • 15
    Jan 15th
    16 Files
  • 16
    Jan 16th
    0 Files
  • 17
    Jan 17th
    0 Files
  • 18
    Jan 18th
    0 Files
  • 19
    Jan 19th
    0 Files
  • 20
    Jan 20th
    0 Files
  • 21
    Jan 21st
    0 Files
  • 22
    Jan 22nd
    0 Files
  • 23
    Jan 23rd
    0 Files
  • 24
    Jan 24th
    0 Files
  • 25
    Jan 25th
    0 Files
  • 26
    Jan 26th
    0 Files
  • 27
    Jan 27th
    0 Files
  • 28
    Jan 28th
    0 Files
  • 29
    Jan 29th
    0 Files
  • 30
    Jan 30th
    0 Files
  • 31
    Jan 31st
    0 Files

Top Authors In Last 30 Days

File Tags

Systems

packet storm

© 2020 Packet Storm. All rights reserved.

Services
Security Services
Hosting By
Rokasec
close