| タイトル | Linksys E5350 1.0.00.037 Improper Authentication (CWE-258 / CWE-306) |
|---|
| 説明 | An improper authentication vulnerability was discovered in Linksys E5350 firmware v1.0.00.037 (latest release; product is end-of-life). The setup wizard's save_settings handler stores the administrator password from the CGI parameter wizard_router_pwd with no non-empty validation, and the handler is itself reachable without authentication in factory state via /wizard/apply.cgi. Once the wizard completes, the httpd authentication core treats wizard_finish=="1" AND close_session=="1" AND http_passwd=="" as an unconditional pass, so the entire management interface - including the command-injection-capable Diagnostics action - becomes permanently usable without credentials. Reproduction (non-destructive): in factory state, POST /wizard/apply.cgi with submit_button=setup_wizard&submit_type=save_settings&wizard_router_pwd= (empty) is accepted (HTTP 200, empty http_passwd persisted); after wizard completion, GET /index.asp with no credentials returns the full 42KB admin page instead of the 4.4KB login page, and POST /apply.cgi accepts the Diagnostics command injection payload unauthenticated. Control experiments confirm all three conditions (wizard_finish, close_session, empty password) are necessary. An attacker present during the setup window can silently convert the router to permanent unauthenticated remote control; a legitimate user who leaves the wizard password blank runs a silently unauthenticated router. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8). Discovered by Zimo-666 via static reverse engineering and dynamic verification with control experiments. |
|---|
| ソース | ⚠️ https://github.com/Zimo-666/E5350-cves/tree/main/02-empty-admin-password-auth-bypass |
|---|
| ユーザー | liuyingqi (UID 102046) |
|---|
| 送信 | 2026年10月11日 08:39 (26 日 ago) |
|---|
| モデレーション | 2026年11月04日 12:40 (24 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 431045 [Linksys E5350 1.0.00.037 Setup Wizard /wizard/apply.cgi save_settings wizard_router_pwd 弱い認証] |
|---|
| ポイント | 20 |
|---|