Linksys WET11 security bypass
| linksys-wet11-security-bypass (20008) |  High Risk |
Description:
Lynksys WET 11 could allow a remote attacker to bypass security restrictions. This vulnerability is caused by the device password being changed without requiring the user to supply the old password. A remote attacker could exploit this vulnerability to set a blank password to bypass security and gain unauthorized access to the device.
Note: It is reported that in order to exploit this vulnerability in version 1.5.4, the user must have recently logged in.
Consequences:
Bypass Security
Remedy:
No remedy available as of July 9, 2011.
References:
- Linksys WET11 Web page: Wireless Ethernet Bridge.
- BID-13051: Linksys WET11 Password Update Remote Authentication Bypass Vulnerability
- CVE-2005-1059: Linksys WET11 1.5.4 allows remote attackers to change the password without providing the original password via the data parameter to changepw.html.
- SA14871: Linksys WET11 Password Change Security Bypass Vulnerability
Platforms Affected:
- Linksys WET11 1.5.4
Reported:
Apr 07, 2005
The information within this database may change without notice. Use of this information constitutes acceptance for use in an AS IS condition. There are NO warranties, implied or otherwise, with regard to this information or its use. Any use of this information is at the user's risk. In no event shall the author/distributor (IBM Internet Security Systems X-Force) be held liable for any damages whatsoever arising out of or in connection with the use or spread of this information.
For corrections or additions please email xforce@iss.net