| 제목 | Linksys E5600 1.1.0.26 Information Disclosure (CWE-200) |
|---|
| 설명 | A pre-authentication information disclosure was discovered in Linksys E5600 firmware v1.1.0.26. /cgi-bin/fqc.cgi is a factory quality-control page that is explicitly listed in the web server authentication exception list (session.exception-uri in lighttpd.conf), so mod_session never requires a session for it. Any unauthenticated network client can retrieve: firmware version, device serial number, all interface MAC addresses (LAN/WAN/2.4G/5G), WiFi ESSIDs, the factory default WiFi passphrase, the factory default WPS PIN, region and boot mode. Reproduction: curl http://<router>/cgi-bin/fqc.cgi (no credentials). Exposure of the default WiFi passphrase and WPS PIN enables direct compromise of the wireless network of devices still running factory wireless credentials, and facilitates targeted attacks and device tracking. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N (6.5). Discovered by Zimo-666 via configuration audit and dynamic verification. |
|---|
| 원천 | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/05-fqc-info-disclosure |
|---|
| 사용자 | liuyingqi (UID 102046) |
|---|
| 제출 | 2026. 10. 10. PM 04:53 (27 날 ago) |
|---|
| 모더레이션 | 2026. 11. 03. PM 05:40 (24 days later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 430466 [Linksys E5600 1.1.0.26 Factory Quality Control /cgi-bin/fqc.cgi 정보 공개] |
|---|
| 포인트들 | 20 |
|---|