CVE-2008-1244 cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing...
HighCVSS 10.0
EPSS 4.9%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
cgi-bin/setup_dns.exe on the Belkin F5D7230-4 router with firmware 9.01.10 does not require authentication, which allows remote attackers to perform administrative actions, as demonstrated by changing a DNS server via the dns1_1, dns1_2, dns1_3, and dns1_4 parameters. NOTE: it was later reported that F5D7632-4V6 with firmware 6.01.08 is also affected.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| belkin f5d7230-4 | All versions | No fix listed |
References
- 29345 third-party-advisory
- www.gnucitizen.org exploit
- 20080301 The Router Hacking Challenge is Over! mailing-list
- 28319 vdb-entry
- bugzilla.mozilla.org exploit
- belkin-f5d72304-setupdns-security-bypass(41124) vdb-entry