VAR-200703-0627
Vulnerability from variot - Updated: 2025-04-10 23:19The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information. Linksys WAG200G is prone to a vulnerability that may disclose sensitive information. An attacker can exploit this issue to retrieve sensitive information that may aid in further attacks. This issue affects firmware version 1.01.01; other versions may also be vulnerable. Linksys WAG200G is a wireless ADSL router.
Want a new job? http://secunia.com/secunia_vacancies/
Secunia is looking for new researchers with a reversing background and experience in writing exploit code: http://secunia.com/hardcore_disassembler_and_reverse_engineer/ http://secunia.com/Disassembling_og_Reversing/ http://secunia.com/Linux_Security_Specialist/
TITLE: Linksys Products Information Disclosure Security Issue
SECUNIA ADVISORY ID: SA24658
VERIFY ADVISORY: http://secunia.com/advisories/24658/
CRITICAL: Moderately critical
IMPACT: Exposure of system information, Exposure of sensitive information
WHERE:
From local network
OPERATING SYSTEM: Linksys WAG200G http://secunia.com/product/13810/ Linksys WRT54GC http://secunia.com/product/13808/
DESCRIPTION: A security issue has been reported in various Linksys products, which can be exploited to disclose certain sensitive information. the product model, the web interface password, the PPPoA username, the PPPoA password, the SSID, and the WPA passphrase by sending a UDP packet to port 916 of the device.
The security issue is reported in WAG200G with firmware 1.01.03 and earlier, WRT54GC v1 with firmware 1.03.0 and earlier, and WRT54GC v2 with firmware 1.00.7 and earlier.
PROVIDED AND/OR DISCOVERED BY: Daniel Niggebrugge, additional information by Bartomiej Ochman
About: This Advisory was delivered by Secunia as a free service to help everybody keeping their systems up to date against the latest vulnerabilities.
Subscribe: http://secunia.com/secunia_security_advisories/
Definitions: (Criticality, Where etc.) http://secunia.com/about_secunia_advisories/
Please Note: Secunia recommends that you verify all advisories you receive by clicking the link. Secunia NEVER sends attached files with advisories. Secunia does not advise people to install third party patches, only use those supplied by the vendor.
Unsubscribe: Secunia Security Advisories http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org
Show details on source website
{
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/VARIoTentry#",
"affected_products": {
"@id": "https://www.variotdbs.pl/ref/affected_products"
},
"configurations": {
"@id": "https://www.variotdbs.pl/ref/configurations"
},
"credits": {
"@id": "https://www.variotdbs.pl/ref/credits"
},
"cvss": {
"@id": "https://www.variotdbs.pl/ref/cvss/"
},
"description": {
"@id": "https://www.variotdbs.pl/ref/description/"
},
"exploit_availability": {
"@id": "https://www.variotdbs.pl/ref/exploit_availability/"
},
"external_ids": {
"@id": "https://www.variotdbs.pl/ref/external_ids/"
},
"iot": {
"@id": "https://www.variotdbs.pl/ref/iot/"
},
"iot_taxonomy": {
"@id": "https://www.variotdbs.pl/ref/iot_taxonomy/"
},
"patch": {
"@id": "https://www.variotdbs.pl/ref/patch/"
},
"problemtype_data": {
"@id": "https://www.variotdbs.pl/ref/problemtype_data/"
},
"references": {
"@id": "https://www.variotdbs.pl/ref/references/"
},
"sources": {
"@id": "https://www.variotdbs.pl/ref/sources/"
},
"sources_release_date": {
"@id": "https://www.variotdbs.pl/ref/sources_release_date/"
},
"sources_update_date": {
"@id": "https://www.variotdbs.pl/ref/sources_update_date/"
},
"threat_type": {
"@id": "https://www.variotdbs.pl/ref/threat_type/"
},
"title": {
"@id": "https://www.variotdbs.pl/ref/title/"
},
"type": {
"@id": "https://www.variotdbs.pl/ref/type/"
}
},
"@id": "https://www.variotdbs.pl/vuln/VAR-200703-0627",
"affected_products": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/affected_products#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"model": "wrt54gc",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.00.7"
},
{
"model": "wag200g",
"scope": "eq",
"trust": 1.6,
"vendor": "linksys",
"version": "1.01.01"
},
{
"model": "wrt54gc",
"scope": "lte",
"trust": 1.0,
"vendor": "linksys",
"version": "1.03.0"
},
{
"model": "wag200g",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "1.01.01"
},
{
"model": "wrt54gc",
"scope": "lte",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "1.00.7"
},
{
"model": "wrt54gc",
"scope": "eq",
"trust": 0.8,
"vendor": "cisco linksys",
"version": "1.03.0"
},
{
"model": "wrt54gc",
"scope": "eq",
"trust": 0.6,
"vendor": "linksys",
"version": "1.03.0"
},
{
"model": "wrt54gc",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "v2.01.0.7"
},
{
"model": "wag200g",
"scope": "eq",
"trust": 0.3,
"vendor": "linksys",
"version": "1.1.1"
}
],
"sources": [
{
"db": "BID",
"id": "23063"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"configurations": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/configurations#",
"children": {
"@container": "@list"
},
"cpe_match": {
"@container": "@list"
},
"data": {
"@container": "@list"
},
"nodes": {
"@container": "@list"
}
},
"data": [
{
"CVE_data_version": "4.0",
"nodes": [
{
"cpe_match": [
{
"cpe22Uri": "cpe:/h:linksys:wag200g",
"vulnerable": true
},
{
"cpe22Uri": "cpe:/h:linksys:wrt54gc",
"vulnerable": true
}
],
"operator": "OR"
}
]
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
}
]
},
"credits": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/credits#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Dani\u0026euml;l Niggebrugge",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
}
],
"trust": 0.6
},
"cve": "CVE-2007-1585",
"cvss": {
"@context": {
"cvssV2": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV2#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV2"
},
"cvssV3": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/cvss/cvssV3#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/cvssV3/"
},
"severity": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/cvss/severity#"
},
"@id": "https://www.variotdbs.pl/ref/cvss/severity"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
},
"@id": "https://www.variotdbs.pl/ref/sources"
}
},
"data": [
{
"cvssV2": [
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "nvd@nist.gov",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "CVE-2007-1585",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 1.8,
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
{
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"author": "VULHUB",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"exploitabilityScore": 10.0,
"id": "VHN-24947",
"impactScore": 2.9,
"integrityImpact": "NONE",
"severity": "MEDIUM",
"trust": 0.1,
"vectorString": "AV:N/AC:L/AU:N/C:P/I:N/A:N",
"version": "2.0"
}
],
"cvssV3": [],
"severity": [
{
"author": "nvd@nist.gov",
"id": "CVE-2007-1585",
"trust": 1.0,
"value": "MEDIUM"
},
{
"author": "NVD",
"id": "CVE-2007-1585",
"trust": 0.8,
"value": "Medium"
},
{
"author": "CNNVD",
"id": "CNNVD-200703-510",
"trust": 0.6,
"value": "MEDIUM"
},
{
"author": "VULHUB",
"id": "VHN-24947",
"trust": 0.1,
"value": "MEDIUM"
}
]
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"description": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/description#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "The Linksys WAG200G with firmware 1.01.01, WRT54GC 2 with firmware 1.00.7, and WRT54GC 1 with firmware 1.03.0 and earlier allow remote attackers to obtain sensitive information (passwords and configuration data) via a packet to UDP port 916. NOTE: some of these details are obtained from third party information. Linksys WAG200G is prone to a vulnerability that may disclose sensitive information. \nAn attacker can exploit this issue to retrieve sensitive information that may aid in further attacks. \nThis issue affects firmware version 1.01.01; other versions may also be vulnerable. Linksys WAG200G is a wireless ADSL router. \n\n----------------------------------------------------------------------\n\nWant a new job?\nhttp://secunia.com/secunia_vacancies/\n\nSecunia is looking for new researchers with a reversing background\nand experience in writing exploit code:\nhttp://secunia.com/hardcore_disassembler_and_reverse_engineer/\nhttp://secunia.com/Disassembling_og_Reversing/\nhttp://secunia.com/Linux_Security_Specialist/\n\n----------------------------------------------------------------------\n\nTITLE:\nLinksys Products Information Disclosure Security Issue\n\nSECUNIA ADVISORY ID:\nSA24658\n\nVERIFY ADVISORY:\nhttp://secunia.com/advisories/24658/\n\nCRITICAL:\nModerately critical\n\nIMPACT:\nExposure of system information, Exposure of sensitive information\n\nWHERE:\n\u003eFrom local network\n\nOPERATING SYSTEM:\nLinksys WAG200G\nhttp://secunia.com/product/13810/\nLinksys WRT54GC\nhttp://secunia.com/product/13808/\n\nDESCRIPTION:\nA security issue has been reported in various Linksys products, which\ncan be exploited to disclose certain sensitive information. the product model, the web interface password, the PPPoA\nusername, the PPPoA password, the SSID, and the WPA passphrase by\nsending a UDP packet to port 916 of the device. \n\nThe security issue is reported in WAG200G with firmware 1.01.03 and\nearlier, WRT54GC v1 with firmware 1.03.0 and earlier, and WRT54GC v2\nwith firmware 1.00.7 and earlier. \n\nPROVIDED AND/OR DISCOVERED BY:\nDaniel Niggebrugge, additional information by Bartomiej Ochman\n\n----------------------------------------------------------------------\n\nAbout:\nThis Advisory was delivered by Secunia as a free service to help\neverybody keeping their systems up to date against the latest\nvulnerabilities. \n\nSubscribe:\nhttp://secunia.com/secunia_security_advisories/\n\nDefinitions: (Criticality, Where etc.)\nhttp://secunia.com/about_secunia_advisories/\n\n\nPlease Note:\nSecunia recommends that you verify all advisories you receive by\nclicking the link. \nSecunia NEVER sends attached files with advisories. \nSecunia does not advise people to install third party patches, only\nuse those supplied by the vendor. \n\n----------------------------------------------------------------------\n\nUnsubscribe: Secunia Security Advisories\nhttp://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org\n\n----------------------------------------------------------------------\n\n\n",
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1585"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "BID",
"id": "23063"
},
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "PACKETSTORM",
"id": "55476"
}
],
"trust": 2.07
},
"external_ids": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/external_ids#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"db": "NVD",
"id": "CVE-2007-1585",
"trust": 2.5
},
{
"db": "BID",
"id": "23063",
"trust": 2.0
},
{
"db": "SECUNIA",
"id": "24658",
"trust": 1.8
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559",
"trust": 0.8
},
{
"db": "BUGTRAQ",
"id": "20070325 RE: LINKSYS WAG200G - INFORMATION DISCLOSURE",
"trust": 0.6
},
{
"db": "BUGTRAQ",
"id": "20070320 LINKSYS WAG200G - INFORMATION DISCLOSURE",
"trust": 0.6
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510",
"trust": 0.6
},
{
"db": "VULHUB",
"id": "VHN-24947",
"trust": 0.1
},
{
"db": "PACKETSTORM",
"id": "55476",
"trust": 0.1
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "BID",
"id": "23063"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "PACKETSTORM",
"id": "55476"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"id": "VAR-200703-0627",
"iot": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/iot#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": true,
"sources": [
{
"db": "VULHUB",
"id": "VHN-24947"
}
],
"trust": 0.6833333
},
"last_update_date": "2025-04-10T23:19:13.231000Z",
"patch": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/patch#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"title": "Linksys",
"trust": 0.8,
"url": "http://home.cisco.com/en-apac/home"
}
],
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
}
]
},
"problemtype_data": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/problemtype_data#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"problemtype": "NVD-CWE-Other",
"trust": 1.0
}
],
"sources": [
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"references": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/references#",
"data": {
"@container": "@list"
},
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": [
{
"trust": 1.7,
"url": "http://www.securityfocus.com/bid/23063"
},
{
"trust": 1.7,
"url": "http://secunia.com/advisories/24658"
},
{
"trust": 1.6,
"url": "http://marc.info/?l=bugtraq\u0026m=117492736903388\u0026w=2"
},
{
"trust": 1.1,
"url": "http://www.securityfocus.com/archive/1/463342/100/0/threaded"
},
{
"trust": 1.1,
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/33251"
},
{
"trust": 0.8,
"url": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=cve-2007-1585"
},
{
"trust": 0.8,
"url": "http://web.nvd.nist.gov/view/vuln/detail?vulnid=cve-2007-1585"
},
{
"trust": 0.6,
"url": "http://www.securityfocus.com/archive/1/archive/1/463342/100/0/threaded"
},
{
"trust": 0.3,
"url": "http://www.linksys.com/"
},
{
"trust": 0.3,
"url": "/archive/1/463342"
},
{
"trust": 0.3,
"url": "/archive/1/463834"
},
{
"trust": 0.3,
"url": "/archive/1/466176"
},
{
"trust": 0.1,
"url": "http://marc.info/?l=bugtraq\u0026amp;m=117492736903388\u0026amp;w=2"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_security_advisories/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13810/"
},
{
"trust": 0.1,
"url": "http://secunia.com/disassembling_og_reversing/"
},
{
"trust": 0.1,
"url": "http://secunia.com/advisories/24658/"
},
{
"trust": 0.1,
"url": "http://secunia.com/secunia_vacancies/"
},
{
"trust": 0.1,
"url": "http://secunia.com/hardcore_disassembler_and_reverse_engineer/"
},
{
"trust": 0.1,
"url": "http://secunia.com/product/13808/"
},
{
"trust": 0.1,
"url": "http://secunia.com/sec_adv_unsubscribe/?email=packet%40packetstormsecurity.org"
},
{
"trust": 0.1,
"url": "http://secunia.com/linux_security_specialist/"
},
{
"trust": 0.1,
"url": "http://secunia.com/about_secunia_advisories/"
}
],
"sources": [
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "BID",
"id": "23063"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "PACKETSTORM",
"id": "55476"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"sources": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#",
"data": {
"@container": "@list"
}
},
"data": [
{
"db": "VULHUB",
"id": "VHN-24947"
},
{
"db": "BID",
"id": "23063"
},
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"db": "PACKETSTORM",
"id": "55476"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"sources_release_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_release_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2007-03-21T00:00:00",
"db": "VULHUB",
"id": "VHN-24947"
},
{
"date": "2007-03-20T00:00:00",
"db": "BID",
"id": "23063"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"date": "2007-04-02T02:42:23",
"db": "PACKETSTORM",
"id": "55476"
},
{
"date": "2007-03-21T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"date": "2007-03-21T23:19:00",
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"sources_update_date": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources_update_date#",
"data": {
"@container": "@list"
}
},
"data": [
{
"date": "2018-10-16T00:00:00",
"db": "VULHUB",
"id": "VHN-24947"
},
{
"date": "2007-04-19T17:11:00",
"db": "BID",
"id": "23063"
},
{
"date": "2012-09-25T00:00:00",
"db": "JVNDB",
"id": "JVNDB-2007-003559"
},
{
"date": "2007-04-10T00:00:00",
"db": "CNNVD",
"id": "CNNVD-200703-510"
},
{
"date": "2025-04-09T00:30:58.490000",
"db": "NVD",
"id": "CVE-2007-1585"
}
]
},
"threat_type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/threat_type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "remote",
"sources": [
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
}
],
"trust": 0.6
},
"title": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/title#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Linksys WAG200G Important information such as ( Password and configuration data ) Vulnerability to be acquired",
"sources": [
{
"db": "JVNDB",
"id": "JVNDB-2007-003559"
}
],
"trust": 0.8
},
"type": {
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/type#",
"sources": {
"@container": "@list",
"@context": {
"@vocab": "https://www.variotdbs.pl/ref/sources#"
}
}
},
"data": "Design Error",
"sources": [
{
"db": "BID",
"id": "23063"
},
{
"db": "CNNVD",
"id": "CNNVD-200703-510"
}
],
"trust": 0.9
}
}
Loading…
Loading…
Experimental. This forecast is provided for visualization only and may change without notice. Do not use it for operational decisions.
Forecast uses a logistic model when the trend is rising, or an exponential decay model when the trend is falling. Fitted via linearized least squares.
Sightings
| Author | Source | Type | Date | Other |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or observed by the user.
- Confirmed: The vulnerability has been validated from an analyst's perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
- Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
- Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
- Not confirmed: The user expressed doubt about the validity of the vulnerability.
- Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.
Loading…
Loading…