← Vulnerability feed

Vulnerability record · CVE-2008-1247 · published 10 March 2008

CVE-2008-1247: Linksys wrt54g permissions and access controls vulnerability

Linksys · Wrt54g

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri. NOTE: the Security.tri vector is already covered by CVE-2006-5202.

10.0 CVSS 2.0 High EPSS 5.2% · top 7.9% CWE-264 · Permissions and access controls
10.0CVSS 2.0 base score
5.2%EPSS exploitation probability, 30 days
NoNot in CISA KEV
1Affected product versions listed by NVD
20References, 2 tagged exploit
16 Jun 2026Last modified by NVD

Description

The web interface on the Linksys WRT54g router with firmware 1.00.9 does not require credentials when invoking scripts, which allows remote attackers to perform arbitrary administrative actions via a direct request to (1) Advanced.tri, (2) AdvRoute.tri, (3) Basic.tri, (4) ctlog.tri, (5) ddns.tri, (6) dmz.tri, (7) factdefa.tri, (8) filter.tri, (9) fw.tri, (10) manage.tri, (11) ping.tri, (12) PortRange.tri, (13) ptrigger.tri, (14) qos.tri, (15) rstatus.tri, (16) tracert.tri, (17) vpn.tri, (18) WanMac.tri, (19) WBasic.tri, or (20) WFilter.tri. NOTE: the Security.tri vector is already covered by CVE-2006-5202.

AV:N/AC:L/Au:N/C:C/I:C/A:C

Affected products

1 vulnerable configurations from NVD's CPE data, grouped by vendor and product.

References

LinkTags
http://kinqpinz.info/lib/wrt54g/own.txt Exploit
http://secunia.com/advisories/29344
http://www.gnucitizen.org/projects/router-hacking-challenge/
http://www.securityfocus.com/archive/1/489009/100/0/threaded
http://www.securityfocus.com/bid/28381
https://exchange.xforce.ibmcloud.com/vulnerabilities/41118
https://kinqpinz.info/lib/wrt54g/
https://kinqpinz.info/lib/wrt54g/own2.txt
https://www.exploit-db.com/exploits/5313
https://www.exploit-db.com/exploits/5926
http://kinqpinz.info/lib/wrt54g/own.txt Exploit
http://secunia.com/advisories/29344
http://www.gnucitizen.org/projects/router-hacking-challenge/
http://www.securityfocus.com/archive/1/489009/100/0/threaded
http://www.securityfocus.com/bid/28381
https://exchange.xforce.ibmcloud.com/vulnerabilities/41118
https://kinqpinz.info/lib/wrt54g/
https://kinqpinz.info/lib/wrt54g/own2.txt
https://www.exploit-db.com/exploits/5313
https://www.exploit-db.com/exploits/5926

Track CVE-2008-1247 inside VULONE

Watch it alongside the ransomware crews, C2 infrastructure and forum chatter that reference it, query it through the API and pull it into your SIEM over TAXII.

Start free Open in platform

Related vulnerabilities

Same products first, then exploited flaws of the same weakness class.

10.0CVE-2008-1268Linksys wrt54g improper authentication vulnerabilityThe FTP server on the Linksys WRT54G 7 router with 7.00.1 firmware does not verify authentication credentials, which allows remote attackers to estab…EPSS 2.5%7.8CVE-2008-1265Linksys wrt54g improper input validation vulnerabilityThe Linksys WRT54G router allows remote attackers to cause a denial of service (device restart) via a long username and password to the FTP interface.EPSS 1.6%7.5CVE-2011-4499Cisco linksys wrt54g router firmware vulnerabilityThe UPnP IGD implementation in the Broadcom UPnP stack on the Cisco Linksys WRT54G with firmware before 4.30.5, WRT54GS v1 through v3 with firmware b…EPSS 1.3%7.5CVE-2008-1264Linksys wrt54g improper authentication vulnerabilityThe Linksys WRT54G router has "admin" as its default FTP password, which allows remote attackers to access sensitive files including nvram.cfg, a fil…EPSS 3.1%7.5CVE-2006-2559Linksys wrt54g vulnerabilityLinksys WRT54G Wireless-G Broadband Router allows remote attackers to bypass access restrictions and conduct unauthorized operations via a UPnP reque…EPSS 1.7%7.5CVE-2005-2799Linksys WRT54G apply.cgi buffer overflow allows remote code executionA buffer overflow exists in apply.cgi on the Linksys WRT54G router (versions 3.01.03, 3.03.6, and possibly others before 4.20.7). A long HTTP POST re…EPSS 71%analysed7.5CVE-2005-2914Linksys wrt54g vulnerabilityezconfig.asp in Linksys WRT54G router 3.01.03, 3.03.6, non-default configurations of 2.04.4, and possibly other versions, does not use an authenticat…EPSS 1.4%7.5CVE-2004-2606Linksys befsr41 v3 vulnerabilityThe Web interface in Linksys WRT54G 2.02.7 and BEFSR41 version 3, with the firewall disabled, allows remote attackers to attempt to login to an admin…EPSS 2.6%

Source: NIST National Vulnerability Database (record CVE-2008-1247), CISA KEV, FIRST EPSS (scores of 2026-09-26). This page is refreshed as NVD updates the record.