| タイトル | Linksys E5600 1.1.0.26 Improper Authentication (CWE-287) |
|---|
| 説明 | An authentication logic flaw was discovered in Linksys E5600 firmware v1.1.0.26. In /cgi-bin/mesh_login.cgi, when the account lookup finds no matching account, the expected-credential output buffers remain empty (zeroed) and the login handler proceeds to compare the attacker-supplied username and password against those empty values instead of rejecting the login. An unauthenticated attacker can therefore authenticate by sending username=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (the SHA-256 hex of the empty string) with an empty password and source="web", receiving a fully privileged admin session (HSESSIONID cookie, level=2 in /tmp/httpd_session). The bypass works regardless of the configured administrator password, because no real account username can hash to SHA-256 of the empty string. Control tests with wrong credentials correctly return 401, confirming the empty-fallback path. This provides a second, independent pre-authentication entry point to the authenticated Lua API command injections, yielding unauthenticated remote root command execution. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8). Discovered by Zimo-666 via static reverse engineering and dynamic verification. |
|---|
| ソース | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/02-mesh-login-auth-bypass |
|---|
| ユーザー | liuyingqi (UID 102046) |
|---|
| 送信 | 2026年10月10日 16:51 (26 日 ago) |
|---|
| モデレーション | 2026年11月03日 17:40 (24 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 430463 [Linksys E5600 1.1.0.26 Login /cgi-bin/mesh_login.cgi 弱い認証] |
|---|
| ポイント | 20 |
|---|