Linksys E-Series Router Vulnerabilities

• Linksys E900, E1200, E8400 (confirmed affected)
• Linksys E900-ME, E1500, E3200, E4200, WRT54G2 (unconfirmed)

Five vulnerabilities have been found in several Linksys E-series routers. These are a Denial of Service (DoS) vulnerability, a Cross-Site Request Forgery (CSRF), a cross-site scripting (XSS) vulnerability, an HTTP header injection and improper session protection. There are currently no patches, though a fairly high level of competence is needed to carry out these attacks.

The DoS attack is the easiest and does not require authentication from the attacker. It can be triggered by a GET request to a CGI-script to either reboot the device or freeze the web interface and Dynamic Host Configuration Protocol (DHCP) service.

The CSRF in the administrator interface occurs through the hijacking of the session ID over a LAN connection. The user is prompted to click on a malicious link, planted by the attacker. Once clicked, the attacker can change the configuration of the targeted device. The vulnerability can also be exploited via the internet if the session ID is internet-facing.

The XSS vulnerability in the administrator interface is exploited similarly to CSRF. With this exploit, the attacker can execute malicious code in the browser sessions of the user.

The HTTP header injection vulnerability involves the attacker sending a malicious request to the HTTP header to redirect the link to another site or steal the session ID of a user.

Improper session protection prompts an administrator to click a malicious link to allow the attacker to steal their session ID. This exploit requires an administrator to open a session before the attack and the attacker to have the same IP address as the administrator’s PC.

• Monitor vendors for availability of patches and apply when they become available.
• Restrict network access to the devices.
• Temporarily power the devices off if they are not required.
• Ensure users are aware of exploitation via malicious links.