| 제목 | Linksys E5600 1.1.0.26 Improper Authentication (CWE-287) |
|---|
| 설명 | An authentication logic flaw was discovered in Linksys E5600 firmware v1.1.0.26. In /cgi-bin/mesh_login.cgi, when the account lookup finds no matching account, the expected-credential output buffers remain empty (zeroed) and the login handler proceeds to compare the attacker-supplied username and password against those empty values instead of rejecting the login. An unauthenticated attacker can therefore authenticate by sending username=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (the SHA-256 hex of the empty string) with an empty password and source="web", receiving a fully privileged admin session (HSESSIONID cookie, level=2 in /tmp/httpd_session). The bypass works regardless of the configured administrator password, because no real account username can hash to SHA-256 of the empty string. Control tests with wrong credentials correctly return 401, confirming the empty-fallback path. This provides a second, independent pre-authentication entry point to the authenticated Lua API command injections, yielding unauthenticated remote root command execution. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8). Discovered by Zimo-666 via static reverse engineering and dynamic verification. |
|---|
| 원천 | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/02-mesh-login-auth-bypass |
|---|
| 사용자 | liuyingqi (UID 102046) |
|---|
| 제출 | 2026. 10. 10. PM 04:51 (27 날 ago) |
|---|
| 모더레이션 | 2026. 11. 03. PM 05:40 (24 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 430463 [Linksys E5600 1.1.0.26 Login /cgi-bin/mesh_login.cgi 약한 인증] |
|---|
| 포인트들 | 20 |
|---|