A vulnerability has been identified in Linksys WRT160N, which could be exploited to conduct cross-site request forgery attacks. This issue is caused due to input validation errors when processing HTTP requests, which could be exploited by attackers to bypass security restrictions and or perform administrative actions by tricking an administrator into visiting a malicious web page.

Affected Products

Linksys WRT160N firmware version 1.02.2 and prior

Solution

VUPEN Security is not aware of any vendor-supplied patch.

References

http://www.vupen.com/english/advisories/2009/0982
http://holisticinfosec.org/content/view/109/45/

Credits

Vulnerability reported by Russ McRee.

Changelog

2009-04-09 : Initial release

Feedback

If you have additional information or corrections for this security advisory please submit them via our contact form.