MESSAGE
| DATE | 2019-06-22 |
| FROM | Ruben Safir
|
| SUBJECT | Subject: [Hangout - NYLXS] On Linksys WAG54G2 1.00.10 devices
|
https://nvd.nist.gov/vuln/detail/CVE-2009-5157
Current Description
On Linksys WAG54G2 1.00.10 devices, there is authenticated command
injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable.
Source: MITRE
Hide Analysis Description
Analysis Description
On Linksys WAG54G2 1.00.10 devices, there is authenticated command
injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable.
Source: MITRE
Impact
CVSS v3.0 Severity and Metrics:
Base Score: 8.8 HIGH
Vector: AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H (V3 legend)
Impact Score: 5.9
Exploitability Score: 2.8
Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): Low
User Interaction (UI): None
Scope (S): Unchanged
Confidentiality (C): High
Integrity (I): High
Availability (A): High
CVSS v2.0 Severity and Metrics:
Base Score: 9.0 HIGH
Vector: (AV:N/AC:L/Au:S/C:C/I:C/A:C) (V2 legend)
Impact Subscore: 10.0
Exploitability Subscore: 8.0
Access Vector (AV): Network
Access Complexity (AC): Low
Authentication (AU): Single
Confidentiality (C): Complete
Integrity (I): Complete
Availability (A): Complete
Additional Information:
Allows unauthorized disclosure of information
Allows unauthorized modification
Allows disruption of service
References to Advisories, Solutions, and Tools
By selecting these links, you will be leaving NIST webspace. We have
provided these links to other web sites because they may have
information that would be of interest to you. No inferences should be
drawn on account of other sites being referenced, or not, from this
page. There may be other web sites that are more appropriate for your
purpose. NIST does not necessarily endorse the views expressed, or
concur with the facts presented on these sites. Further, NIST does not
endorse any commercial products that may be mentioned on these sites.
Please address comments about this page to nvd-at-nist.gov.
Hyperlink Resource
https://www.securityfocus.com/archive/1/503934 Exploit Third Party
Advisory VDB Entry
https://www.securityfocus.com/bid/35142 Third Party Advisory VDB Entry
Technical Details
Vulnerability Type (View All)
Command Injection (CWE-77)
Known Affected Software Configurations Switch to CPE 2.2
Configuration 1 ( hide )
cpe:2.3:o:linksys:wag54g2_firmware:1.00.10:*:*:*:*:*:*:*
Show Matching CPE(s)
Running on/with
cpe:2.3:h:linksys:wag54g2:-:*:*:*:*:*:*:*
Show Matching CPE(s)
--
So many immigrant groups have swept through our town
that Brooklyn, like Atlantis, reaches mythological
proportions in the mind of the world - RI Safir 1998
http://www.mrbrklyn.com
DRM is THEFT - We are the STAKEHOLDERS - RI Safir 2002
http://www.nylxs.com - Leadership Development in Free Software
http://www.brooklyn-living.com
Being so tracked is for FARM ANIMALS and extermination camps,
but incompatible with living as a free human being. -RI Safir 2013
_______________________________________________
Hangout mailing list
Hangout-at-nylxs.com
http://lists.mrbrklyn.com/mailman/listinfo/hangout
|
|
