Linksys WRT54 GL - Session riding (CSRF)

Συζήτηση γύρω από θέματα υλικού
Post Reply
Posts: 291
Joined: Mon Mar 12, 2007 2:47 pm
PWMN Wind ID: 0

Linksys WRT54 GL - Session riding (CSRF)

Post by trv » Tue Jan 08, 2008 6:51 pm


Team Intell Security Advisory TISA2008-01


Linksys WRT54 GL - Session riding (CSRF)


Release date: 07.01.2008

Severity: High

Remote-Exploit: yes

Impact: Session riding

Status: Official patch not available

Software: Linksys WRT54 GL

Tested on: firmware version 4.30.9


Vendor-Status: informed on 14.08.2007

Disclosed by: Tomaz Bratusa (Team Intell)[TISA-2008-01]



The Linksys Wireless-G Broadband Router is really three devices in one box. First, there's the Wireless Access Point, which lets you connect both screaming fast Wireless-G (802.11g at 54Mbps) and Wireless-B (802.11b at 11Mbps) devices to the network. There's also a built-in 4-port full-duplex 10/100 Switch to connect your wired-Ethernet devices together. Connect four PCs directly, or attach more hubs and switches to create as big a network as you need. Finally, the Router function ties it all together and lets your whole network share a high-speed cable or DSL Internet connection.

Security Risk


Linksys WRT54GL is prone to an authentication-bypass vulnerability. Reportedly, the device permits changes in its configuration settings without requring authentication (CSRF).

Technical Description


Linksys WRT54GL is prone to an authentication-bypass vulnerability. The problem presents itself when a victim user visits a specially crafted web page on an attacker-controlled site. An attacker can exploit this vulnerability to bypass authentication and modify the configuration settings of the device.

If the administrator of Linksys WRT54GL is logged into the device and opens a malicious website or email with the same browser, he is subject to attacks.

Imagine the worst case, where the administrator is constantly logged into his firewall appliance because he needs to configure changes throughout

the day. A malicious link executing unnoticed by the administrator may open the firewall.

This issue is reported to affect firmware version 4.30.9; other firmware versions may also be affected.


=== ... tion=&acti

Folowing the previous link will disable the firewall on on your LAN.



1.No official patch yet.

2.Do not surf the web when you are configuring your router.





14.08.2007 discovery of the vulnerability

14.08.2007 contacted the vendor

14.08.2008 Response from Cisco - They are working on it

22.10.2007 Request for status

30.10.2007 Response from Cisco - They will include the patch in the next firmware upgrade

07.01.2008 advisory is written

07.01.2008 Vulnerability is made public




Maldin d.o.o.

Trzaska cesta 2

1000 Ljubljana - SI

tel: +386 (0)590 70 170

fax: +386 (0)590 70 177

gsm: +386 (0)31 816 400


e-mail: info(at)




The content of this report is purely informational and meant for educational purposes only. Maldin d.o.o. shall in no event be liable for any damage whatsoever, direct or implied, arising from use or spread of this information. Any use of information in this advisory is entirely at user's own risk.

User avatar
Pentium IV
Posts: 1044
Joined: Thu May 17, 2007 2:53 am
PWMN Wind ID: 137
Location: Patra (most of the time)

Post by panoulix » Tue Jan 08, 2008 8:45 pm

Α πάρα πολύ ωραία...
Your mind is twisted. How can I resist it?

Posts: 2
Joined: Mon Aug 05, 2019 5:31 pm
PWMN Wind ID: 0
Location: Panama

Linksys WRT54 GL Session riding CSRF

Post by Kamawand » Mon Aug 12, 2019 2:22 am

I bought a WRT610N, went through the installation and it doesnt bloody work hooray, well done linksys, another success story.

Im with telefonica ADSL2, its an ADSL2 router. I chose PPPoE and enter the username "adslppptelefonicanetpa" and the same password. I put MTU to auto.

This is the only configuration I could find, and thats it. Its strange that there is no VPI/VCI, etc.

Can someone on telefonica please post there settings?

Post Reply

Who is online

Users browsing this forum: No registered users and 1 guest