Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2007-3574 — Cross-site Scripting in Linksys Wag54gs

CWE-79 — Cross-site Scripting4 documents4 sources

Severity

4.3MEDIUMNVD

EPSS

8.8%

top 7.45%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Linksys Wag54gs

Timeline

PublishedJul 5

Latest updateMay 1

Description

Multiple cross-site scripting (XSS) vulnerabilities in setup.cgi on the Cisco Linksys WAG54GS Wireless-G ADSL Gateway with 1.00.06 firmware allow remote attackers to inject arbitrary web script or HTML via the (1) c4_trap_ip_, (2) devname, (3) snmp_getcomm, or (4) snmp_setcomm parameter.

CVSS vector

AV:N/AC:M/C:N/I:P/A:NExploitability: 8.6 | Impact: 2.9

Affected Packages1 packages

▶NVDlinksys/wag54gs1.00.06

🔴Vulnerability Details

GHSA

GHSA-8pcm-74vv-2c6m: Multiple cross-site scripting (XSS) vulnerabilities in setup↗2022-05-01

▶

CVEList

CVE-2007-3574: Multiple cross-site scripting (XSS) vulnerabilities in setup↗2007-07-05

▶

💥Exploits & PoCs

Exploit-DB

Linksys WAG54GS 1.0.6 (Wireless-G ADSL Gateway) - 'setup.cgi' Cross-Site Scripting↗2007-06-27

▶