QwikSec

Security Database

CVE

CWE

Training

CVE-2008-1334

Published: Mar 13, 2008

Modified: Aug 7, 2024

PUBLISHED

Description

cgi/b on the BT Home Hub router allows remote attackers to bypass authentication, and read or modify administrative settings or make arbitrary VoIP telephone calls, by placing a character at the end of the PATH_INFO, as demonstrated by (1) %5C (encoded backslash), (2) '%' (percent), and (3) '~' (tilde). NOTE: the '/' (slash) vector is already covered by CVE-2007-5383.

Vendor	Product	Versions
n/a	n/a	affected `n/a`

References

http://www.gnucitizen.org/blog/holes-in-embedded-devices-authentication-bypass-pt-1/

x_refsource_MISC

20080301 The Router Hacking Challenge is Over!

mailing-list

x_refsource_BUGTRAQ

http://www.gnucitizen.org/projects/router-hacking-challenge/

x_refsource_MISC

bthomehub-cgib-auth-bypass(41271)

vdb-entry

x_refsource_XF

Security Training

Train your team to recognize and prevent security threats with our comprehensive security awareness program.

Vulnerability Scanning

Discover vulnerabilities in your applications and infrastructure before attackers do.