CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 0CVE-2009-5140
https://notcve.org/view.php?id=CVE-2009-5140
The SIP implementation on the Linksys SPA2102 phone adapter provides hashed credentials in a response to an invalid authentication challenge, which makes it easier for remote attackers to obtain access via a brute-force attack, related to a "SIP Digest Leak" issue. La implementación SIP en el adaptador de teléfono Linksys SPA2102, proporciona credenciales en hash en respuesta a un desafío de autenticación no válido, lo que facilita a atacantes remotos obtener acceso por medio de un ataque de fuerza bruta, relacionado con un problema de "SIP Digest Leak". • http://voipsa.org/pipermail/voipsec_voipsa.org/2009-April/002946.html https://resources.enablesecurity.com/resources/sipdigestleak-tut.pdf • CWE-307: Improper Restriction of Excessive Authentication Attempts •
CVSS: 5.4EPSS: 0%CPEs: 2EXPL: 1CVE-2013-3067
https://notcve.org/view.php?id=CVE-2013-3067
Linksys WRT310Nv2 2.0.0.1 is vulnerable to XSS. Linksys WRT310N v2 2.0.0.1, es vulnerable a un ataque de tipo XSS. • http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf http://securityevaluators.com/knowledge/case_studies/routers/linksys_wrt310v2.php https://www.ise.io/research/studies-and-papers/linksys_wrt310v2 • CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') •
CVSS: 9.8EPSS: 1%CPEs: 6EXPL: 1CVE-2019-16340
https://notcve.org/view.php?id=CVE-2019-16340
Belkin Linksys Velop 1.1.8.192419 devices allows remote attackers to discover the recovery key via a direct request for the /sysinfo_json.cgi URI. Los dispositivos Belkin Linksys Velop versión 1.1.8.192419, permiten a atacantes remotos detectar la clave de recuperación mediante una petición directa para el URI /sysinfo_json.cgi. • http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/WHW03_A03_Velop_Customer_Release_Notes_1.1.9.195026.txt https://puzzor.github.io/Linksys-Velop-Authentication-bypass https://www.linksys.com/us/support-article?articleNum=207568 • CWE-425: Direct Request ('Forced Browsing') •
CVSS: 10.0EPSS: 0%CPEs: 2EXPL: 1CVE-2013-4658
https://notcve.org/view.php?id=CVE-2013-4658
Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share. Linksys EA6500, presenta un Salto de Enlace Simbólico de SMB permitiendo crear enlaces simbólicos a ubicaciones fuera del recurso compartido Samba. • https://www.ise.io/casestudies/exploiting-soho-routers https://www.ise.io/soho_service_hacks https://www.ise.io/wp-content/uploads/2017/06/soho_defcon21.pdf • CWE-22: Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal') •
CVSS: 10.0EPSS: 0%CPEs: 4EXPL: 0CVE-2019-11535
https://notcve.org/view.php?id=CVE-2019-11535
Unsanitized user input in the web interface for Linksys WiFi extender products (RE6400 and RE6300 through 1.2.04.022) allows for remote command execution. An attacker can access system OS configurations and commands that are not intended for use beyond the web UI. Una entrada de usuario no saneada en la interfaz web para los productos extensores de WiFi de Linksys (RE6400 y RE6300 hasta versión 1.2.04.022), permite la ejecución de comandos remota. Un atacante puede acceder a las configuraciones del sistema operativo del sistema y a los comandos que no fueron destinados para su uso fuera de la interfaz de usuario web. • http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/Linksys%20RE6300%20RE6400%20Firmware%20Release%20Notes_v1.2.05.001.txt • CWE-77: Improper Neutralization of Special Elements used in a Command ('Command Injection') •