Vulnerability CVE-2014-8244


Published: 2014-11-01

Description:
Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain sensitive information or modify data via a JNAP action in a JNAP/ HTTP request.

Type:

CWE-200

(Information Exposure)

Vendor: Linksys
Product: Ea3500 firmware 
Version: 2.0.14294;
Product: Ea2700 firmware 
Version: 2.0.14294;
Product: Ea4500 firmware 
Version: 2.0.14212.1;
Product: E4200v2 firmware 
Version: 2.0.14212.1;
Product: Ea6900 firmware 
Version: 1.1.42;
Product: Ea6200 firmware 
Version: 1.1.41;
Product: Ea6500 firmware 
Version: 1.1.40;
Product: Ea6400 firmware 
Version: 1.1.40;
Product: Ea6700 firmware 
Version: 1.1.40;
Product: Ea6300 firmware 
Version: 1.1.40;
Product: Ea6300 
Product: E4200v2 
Product: Ea6500 
Product: Ea3500 
Product: Ea6900 
Product: Ea6200 
Product: Ea6400 
Product: Ea2700 
Product: Ea6700 
Product: Ea4500 

CVSS2 => (AV:N/AC:L/Au:N/C:P/I:P/A:P)

CVSS Base Score
Impact Subscore
Exploitability Subscore
7.5/10
6.4/10
10/10
Exploit range
Attack complexity
Authentication
Remote
Low
No required
Confidentiality impact
Integrity impact
Availability impact
Partial
Partial
Partial

 References:
http://www.kb.cert.org/vuls/id/447516

Related CVE
CVE-2019-11535
Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote command execution. An attacker can access system OS configurations and commands that are not intended for use beyo...
CVE-2019-7579
An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. An ability exists for an unauthenticated user to browse a confidential ui/1.0.99.187766/dynamic/js/setup.js.localized file on the router's webserver, allowing for an attacker to iden...
CVE-2009-5157
On Linksys WAG54G2 1.00.10 devices, there is authenticated command injection via shell metacharacters in the setup.cgi c4_ping_ipaddr variable.
CVE-2019-7311
An issue was discovered on Linksys WRT1900ACS 1.0.3.187766 devices. A lack of encryption in how the user login cookie (admin-auth) is stored on a victim's computer results in the admin password being discoverable by a local attacker, and usable to ga...
CVE-2018-3955
An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04). Specially crafted entries to network configuration information can caus...
CVE-2018-3954
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NV...
CVE-2018-3953
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NV...
CVE-2018-17208
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible i...

Copyright 2019, cxsecurity.com

 

Back to Top