| Titre | Linksys E5600 1.1.0.26 Improper Authentication (CWE-287) |
|---|
| Description | An authentication logic flaw was discovered in Linksys E5600 firmware v1.1.0.26. In /cgi-bin/mesh_login.cgi, when the account lookup finds no matching account, the expected-credential output buffers remain empty (zeroed) and the login handler proceeds to compare the attacker-supplied username and password against those empty values instead of rejecting the login. An unauthenticated attacker can therefore authenticate by sending username=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (the SHA-256 hex of the empty string) with an empty password and source="web", receiving a fully privileged admin session (HSESSIONID cookie, level=2 in /tmp/httpd_session). The bypass works regardless of the configured administrator password, because no real account username can hash to SHA-256 of the empty string. Control tests with wrong credentials correctly return 401, confirming the empty-fallback path. This provides a second, independent pre-authentication entry point to the authenticated Lua API command injections, yielding unauthenticated remote root command execution. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8). Discovered by Zimo-666 via static reverse engineering and dynamic verification. |
|---|
| La source | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/02-mesh-login-auth-bypass |
|---|
| Utilisateur | liuyingqi (UID 102046) |
|---|
| Soumission | 10/10/2026 16:51 (il y a 27 jours) |
|---|
| Modérer | 03/11/2026 17:40 (24 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 430463 [Linksys E5600 1.1.0.26 Login /cgi-bin/mesh_login.cgi authentification faible] |
|---|
| Points | 20 |
|---|