| Título | Linksys E5600 1.1.0.26 Improper Authentication (CWE-287) |
|---|
| Descrição | An authentication logic flaw was discovered in Linksys E5600 firmware v1.1.0.26. In /cgi-bin/mesh_login.cgi, when the account lookup finds no matching account, the expected-credential output buffers remain empty (zeroed) and the login handler proceeds to compare the attacker-supplied username and password against those empty values instead of rejecting the login. An unauthenticated attacker can therefore authenticate by sending username=e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 (the SHA-256 hex of the empty string) with an empty password and source="web", receiving a fully privileged admin session (HSESSIONID cookie, level=2 in /tmp/httpd_session). The bypass works regardless of the configured administrator password, because no real account username can hash to SHA-256 of the empty string. Control tests with wrong credentials correctly return 401, confirming the empty-fallback path. This provides a second, independent pre-authentication entry point to the authenticated Lua API command injections, yielding unauthenticated remote root command execution. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8). Discovered by Zimo-666 via static reverse engineering and dynamic verification. |
|---|
| Fonte | ⚠️ https://github.com/Zimo-666/E5600-cves/tree/main/02-mesh-login-auth-bypass |
|---|
| Utilizador | liuyingqi (UID 102046) |
|---|
| Submissão | 10/10/2026 16h51 (há 27 dias) |
|---|
| Moderação | 03/11/2026 17h40 (24 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 430463 [Linksys E5600 1.1.0.26 Login /cgi-bin/mesh_login.cgi Autenticação fraca] |
|---|
| Pontos | 20 |
|---|