CVE-2008-1263
CVE-2008-1263 is a medium-severity vulnerability in Linksys Wrt54g with a CVSS 2.0 base score of 4.0. It is not currently listed as actively exploited by CISA, and its EPSS exploit-prediction score is low. The underlying weakness is classified as CWE-310.
Key facts
- Severity: Medium (CVSS 2.0 base score 4.0)
- EPSS exploit prediction: 1% (60th percentile)
- Actively exploited: Not listed in CISA KEV
- Weakness: CWE-310
- Affected product: Linksys Wrt54g
- Published:
- Last modified:
Description
The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file, which might allow remote authenticated users to obtain sensitive information via an HTTP request for the top-level Config.bin URI.
Frequently asked questions
- What is CVE-2008-1263?
- The Linksys WRT54G router stores passwords and keys in cleartext in the Config.bin file, which might allow remote authenticated users to obtain sensitive information via an HTTP request for the top-level Config.bin URI.
- How severe is CVE-2008-1263?
- CVE-2008-1263 has a CVSS 2.0 base score of 4.0, rated medium severity.
- Is CVE-2008-1263 being actively exploited?
- It is not currently listed in CISA's KEV catalog. Its EPSS exploit-prediction score is 1% (60th percentile), an estimate of the probability of exploitation in the next 30 days.
- What products are affected by CVE-2008-1263?
- CVE-2008-1263 affects Linksys Wrt54g. See the affected-products list for the exact vulnerable versions.
- How do I fix CVE-2008-1263?
- Review the linked vendor and NVD advisories for patched versions and mitigations, then upgrade or apply the recommended workaround.
- When was CVE-2008-1263 published?
- CVE-2008-1263 was published on 2008-03-10 and last updated on 2026-06-16.
References
- http://www.gnucitizen.org/projects/router-hacking-challenge/
- http://www.securityfocus.com/archive/1/489009/100/0/threaded
- https://exchange.xforce.ibmcloud.com/vulnerabilities/41115
Affected products (1)
- cpe:2.3:h:linksys:wrt54g:*:*:*:*:*:*:*:*
More vulnerabilities in Linksys Wrt54g
- CVE-2008-1247 — Critical (CVSS 10.0): The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts,…
- CVE-2008-1268 — Critical (CVSS 10.0): The FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which…
- CVE-2008-1265 — High (CVSS 7.8): The Linksys WRT54G router allows remote attackers to cause a denial of service (device restart) via a long username and…
- CVE-2011-4499 — High (CVSS 7.5): The UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS…
- CVE-2008-1264 — High (CVSS 7.5): The Linksys WRT54G router has "admin" as its default FTP password, which allows remote attackers to access sensitive…
- CVE-2006-2559 — High (CVSS 7.5): Linksys WRT54G Wireless-G Broadband Router allows remote attackers to bypass access restrictions and conduct…
All CVEs affecting Linksys Wrt54g →
Other CWE-310 (Cryptographic Issues) vulnerabilities
- CVE-2014-7878 — Critical (CVSS 10.0): The Application Lifecycle Service (ALS) in HP Helion Cloud Development Platform 1.0, when a virtual machine is derived…
- CVE-2013-3712 — Critical (CVSS 10.0): SUSE Studio Onsite 1.3.x before 1.3.6 and SUSE Studio Extension for System z 1.3 uses "static" secret tokens, which has…
- CVE-2013-6952 — Critical (CVSS 10.0): The Belkin WeMo Home Automation firmware before 3949 has a hardcoded GPG key, which makes it easier for remote…
- CVE-2013-6838 — Critical (CVSS 10.0): An unspecified Enghouse Interactive Professional Services "addon product" in Enghouse Interactive IVR Pro (VIP2000)…
- CVE-2013-0137 — Critical (CVSS 10.0): The default configuration of the Digital Alert Systems DASDEC EAS device before 2.0-2 and the Monroe Electronics R189…
- CVE-2011-5123 — Critical (CVSS 10.0): The Antivirus component in Comodo Internet Security before 5.3.175888.1227 does not check whether X.509 certificates in…