XSS, LFI in Cisco, Linksys E4200 Firmware
CVE-2013-2678, CVE-2013-2679, CVE-2013-2680, CVE-2013-2681, CVE-2013-2682, CVE-2013-2683, CVE-2013-2684
Reflected XSS + LFI Bugs in the Cisco, Linksys E4200 Wireless Router Firmware Version: 1.0.05 build 7 were discovered by our Researchers in January 2013 and finally acknowledged by Linksys in April 2013. The Vendor is unable to Patch the Vulnerability in a reasonable timeframe. This document will introduce and discuss the vulnerability and provide Proof-of-Concept (PoC) Zero Day (0D) code examples for Firmware L Version 1.10 Released on July 9, 2012, and prior versions.
Linksys is a brand of home and small office networking products and a company founded in 1988, which was acquired by Cisco Systems in 2003. In 2013, as part of its push away from the consumer market, Cisco sold their home networking division and Linksys to Belkin. Former Linksys products are now branded as Linksys by Cisco.
Products currently and previously sold under the Linksys brand name include broadband and wireless routers, consumer and small business grade Ethernet switching, VoIP equipment, wireless internet video camera, AV products, network storage systems, and other products.
Linksys products were widely available in North America off-the-shelf from both consumer electronics stores (CompUSA and Best Buy), internet retailers, and big-box retail stores (WalMart). Linksys' significant competition as an independent networking firm were D-Link and NetGear, the latter for a time being a brand of Cisco competitor Nortel.
# Copyright (C) 2009, CyberTAN Corporation
# All Rights Reserved.
# THIS SOFTWARE IS OFFERED "AS IS", AND CYBERTAN GRANTS NO WARRANTIES OF ANY
# KIND, EXPRESS OR IMPLIED, BY STATUTE.....
POST /storage/apply.cgi HTTP/1.1
/apply.cgi [log_type parameter]
/apply.cgi [ping_ip parameter]
/apply.cgi [ping_size parameter]
/apply.cgi [submit_type parameter]
/apply.cgi [traceroute_ip parameter]
/storage/apply.cgi [new_workgroup parameter]
/storage/apply.cgi [submit_button parameter]
POST /apply.cgi HTTP/1.1
Other XSS PoC’s
File path traversal CVE-2013-2678
Cross-site scripting (reflected) CVE-2013-2679
Cleartext submission of password CVE-2013-2680
Password field with autocomplete enabled CVE-2013-2681
Frameable response (Clickjacking) CVE-2013-2682
Private IP addresses disclosed CVE-2013-2683
HTML does not specify charset CVE-2013-2684
CVSS Version 2 Score = 4.5