Secunia

Two vulnerabilities have been reported in 2wire routers, which can be exploited by malicious people to conduct cross-site request forgery attacks and bypass certain security restrictions.

1) The vulnerability is caused due the administrative web interface allowing users to perform certain sensitive actions via HTTP requests without verifying the validity of the user's request. This can be exploited to perform certain actions on the device when a logged in administrator is tricked into visiting a malicious web page.

This vulnerability is reported in 1701HG version 3.17.5 and 2071 Gateway version 5.29.51. Other versions may also be affected.

2) An error due to the web interface not authenticating requests sent to the "xslt" script can be exploited to e.g. reset administrative credentials when the "page" parameter is set to "H04_POST".

This vulnerability is reported in 2701HG-B Gateway versions 5.29.103.13, 5.29.109.5, and 5.29.109.13. Other versions may also be affected.

Solution
Do not browse untrusted web sites while being logged in to the administrative section of the device. Restrict access to trusted hosts only using a firewall.
Further details available in Customer Area

Provided and/or discovered by
1) hkm
2) Eduardo Espina García, UNAM CERT.

Changelog
Further details available in Customer Area

Original Advisory
hkm:
http://archives.neohapsis.com/archives/bugtraq/2007-08/0226.html

UNAM CERT (Spanish):
http://www.seguridad.unam.mx/doc/?ap=tutorial&id=196

Deep Links
Links available in Customer Area