Summaryinfo

A vulnerability identified as critical has been detected in Linksys EA6500. This impacts an unknown function of the component Configuration Validator. The manipulation leads to privileges management. There is not any exploit available.

Detailsinfo

A vulnerability was found in Linksys EA6500 (Router Operating System) (affected version not known) and classified as critical. This issue affects some unknown functionality of the component Configuration Validator. The manipulation with an unknown input leads to a privileges management vulnerability. Using CWE to declare the problem leads to CWE-269. The product does not properly assign, modify, track, or check privileges for an actor, creating an unintended sphere of control for that actor. Impacted is confidentiality, integrity, and availability.

The weakness was released 07/26/2013 by Jacob Thompson with Independent Security Evaluators as not defined advisory (Website). The advisory is shared at securityevaluators.com. The attack may be initiated remotely. A simple authentication is required for exploitation. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1068 for this issue. The advisory points out:

With social engineering and a malicious configuration files, an attacker and gain shell access to Linksys EA6500

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The vulnerability is also documented in the vulnerability database at OSVDB (97712†). news.cnet.com is providing further details. Entries connected to this vulnerability are available at VDB-9805, VDB-9806, VDB-10479 and VDB-10480. If you want to get the best quality for vulnerability data then you always have to consider VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Linksys

Name

• EA6500

License

• commercial

Website

• Vendor: https://www.linksys.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Discussion