bugtraq - Linksys E2500 and E1200 (Unauth Command Injection)

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Message-Id: <201608142142.u7ELgRgH012428@sf01web2.securityfocus.com>
Date: Sun, 14 Aug 2016 21:42:27 GMT
From: samhuntley84@...il.com
To: bugtraq@...urityfocus.com
Subject: Linksys E2500 and E1200 (Unauth Command Injection)

Linksys E2500 and E1200 suffer from missing command injection issue in parental control parameters. This allows an attacker to change the control the device remotely.

Combining the attack of no authorization control, it allows an attacker to actually execute unauthenticated command injection attack and thus control the entire device.

More info at:
http://www.samuelhuntley.com/?p=141
http://www.samuelhuntley.com/?p=135

Initial disclosure date: 04/12/16
Fixed date as per Linksys contact: 7/4/16
Linksys contact: Benjamin Samuels,  Calvin Clark (security@...ksys.com)