CVE-2013-3064 - Open redirect vulnerability in ui/dynamic/unsecured.html in Linksys EA6500 with firmware 1.1.28.1478

CVE-2013-3064

Summary

Open redirect vulnerability in ui/dynamic/unsecured.html in Linksys EA6500 with firmware 1.1.28.147876 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via a URL in the target parameter. <a href = "http://cwe.mitre.org/data/definitions/601.html"> CWE-601: URL Redirection to Untrusted Site ('Open Redirect') </a>

References

http://securityevaluators.com/knowledge/case_studies/routers/linksys_ea6500.php
http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf

Vulnerable Configurations

cpe:2.3:o:linksys:ea6500_firmware:1.1.28.147876:*:*:*:*:*:*:*
cpe:2.3:o:linksys:ea6500_firmware:1.1.28.147876:*:*:*:*:*:*:*
cpe:2.3:h:linksys:ea6500:-:*:*:*:*:*:*:*
cpe:2.3:h:linksys:ea6500:-:*:*:*:*:*:*:*

CVSS

Base:	6.8 (as of 30-09-2014 - 18:23)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	PARTIAL

cvss-vector via4

AV:N/AC:M/Au:N/C:P/I:P/A:P

refmap via4

misc

http://securityevaluators.com/knowledge/case_studies/routers/Vulnerability_Catalog.pdf
http://securityevaluators.com/knowledge/case_studies/routers/linksys_ea6500.php

Last major update

30-09-2014 - 18:23

Published

29-09-2014 - 22:55

Last modified

30-09-2014 - 18:23