Cisco Linksys EA2700 URL Slash Character information disclosure

Summaryinfo

A vulnerability, which was classified as problematic, has been found in Cisco Linksys EA2700. This affects an unknown function of the component URL Handler. Performing a manipulation with the input / as part of Slash Character results in information disclosure. Moreover, an exploit is present. It is recommended to replace the affected component with an alternative.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Cisco Linksys EA2700 (Router Operating System) (affected version unknown). This affects an unknown functionality of the component URL Handler. The manipulation with the input value / leads to a information disclosure vulnerability. CWE is classifying the issue as CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. This is going to have an impact on confidentiality.

The weakness was disclosed 04/05/2013 by Phil Purviance as Don't Use Linksys Routers as not defined blog post (Website). It is possible to read the advisory at superevr.com. The vendor was not involved in the public release. The exploitability is told to be easy. It is possible to initiate the attack remotely. The successful exploitation needs a authentication. Technical details and a public exploit are known. The attack technique deployed by this issue is T1592 according to MITRE ATT&CK.

A public exploit has been developed by Phil Purviance in HTTP Request and been published immediately after the advisory. The exploit is shared for download at superevr.com. It is declared as proof-of-concept. The vulnerability was handled as a non-public zero-day exploit for at least 31 days. During that time the estimated underground price was around $5k-$25k.

The problem might be mitigated by replacing the product with as an alternative.

The vulnerability is also documented in the vulnerability database at OSVDB (92232†). Further details are available at arstechnica.com. The entries VDB-7439, VDB-7609 and VDB-7610 are pretty similar. Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Cisco

Name

• Linksys EA2700

License

• commercial

Website

• Vendor: https://www.cisco.com/

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion