Secunia

Some vulnerabilities have been reported in A-LINK WL54AP3 and WL54AP2, which can be exploited by malicious people to conduct cross-site scripting or cross-site request forgery attacks.

1) Input passed via the domain name in the management interface is not properly sanitised before being returned to the user. This can be exploited to execute arbitrary HTML and script code in the user's browser session in context of the web interface.

2) The web interface allows users to perform certain actions via HTTP requests without performing any validity checks to verify the request. This can be exploited to e.g. change the administrative user's username and password, or DNS settings by enticing a logged-in user to visit a malicious site.

Solution
Update to version 1.4.2.
Further details available in Customer Area

Provided and/or discovered by
Jussi Vuokko and Henri Lindberg, Louhi Networks Information Security Research

Changelog
Further details available in Customer Area

Original Advisory
A-LINK:
http://www.a-link.com/WL54AP3.html

Louhi Networks:
http://www.louhinetworks.fi/advisory/alink_081028.txt

Deep Links
Links available in Customer Area