Secunia

Ginsu Rabbit has reported a vulnerability and a security issue in Linksys WRT54G, which can be exploited by malicious people to conduct cross-site request forgery attacks and manipulate the configuration.

1) An error in Security.tri caused due to missing authentication verification can be exploited to modify sensitive configuration settings (e.g. disable wireless security).

2) An error exists in the web interface caused due to the device allowing users to change the router configuration via HTTP requests without performing any validity checks to verify the user's request.

The vulnerability and the security issue have been reported in firmware version 1.00.9 on a V5 router. Other versions may also be affected.

Solution
Filter traffic to affected devices and do not visit untrusted web sites while being logged in to the device.
Further details available in Customer Area

Provided and/or discovered by
Ginsu Rabbit

Changelog
Further details available in Customer Area

Original Advisory
http://lists.grok.org.uk/pipermail/full-disclosure/2006-August/048495.html

Other references
Further details available in Customer Area

Deep Links
Links available in Customer Area