Linksys WAG200G Multiple Security Vulnerabilities

Release date:
Updated on:

Affected Systems:
Linksys WAG200G 1.01.06
Description:
--------------------------------------------------------------------------------
Bugtraq id: 57879

Linksys WAG200G is a wireless ADSL Router.

Linksys WAG200G does not properly verify user input, and the cross-site scripting vulnerability exists. Attackers use the policy_name parameter to inject malicious scripts into the webpage, and then execute arbitrary code in the context of the website. The command injection vulnerability also exists, allowing you to execute arbitrary commands.

<* Source: m-1-k-3

Link: http://packetstormsecurity.com/files/120211/Linksys-WAG200G-XSS-Command-Injection.html
Http://xforce.iss.net/xforce/xfdb/82000
*>

Suggestion:
--------------------------------------------------------------------------------
Vendor patch:

Linksys
-------
Currently, the vendor does not provide patches or upgrade programs. We recommend that users who use the software follow the vendor's homepage to obtain the latest version:

Http://homesupport.cisco.com/en-us/support/gateways/WAG200G