« Volver al listado

CVE-2009-1559

Estado: ModificadaAlta (7.8)—

Absolute path traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R24 and possibly 1.00R22 allows remote attackers to read arbitrary files via an absolute pathname in the this_file parameter. NOTE: traversal via a .. (dot dot) is probably also possible.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

Cisco — Wvc54gca

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2009-1559",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 7.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
          "authentication": "NONE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 6.9,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 10,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2009-05-06T16:30:00.657",
  "references": [
    {
      "url": "http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-3/",
      "tags": [
        "Exploit"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/bid/34713",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/1173",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "cve@mitre.org"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50231",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.gnucitizen.org/blog/hacking-linksys-ip-cameras-pt-3/",
      "tags": [
        "Exploit"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/bid/34713",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.vupen.com/english/advisories/2009/1173",
      "tags": [
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/50231",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-22"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Absolute path traversal vulnerability in adm/file.cgi on the Cisco Linksys WVC54GCA wireless video camera with firmware 1.00R24 and possibly 1.00R22 allows remote attackers to read arbitrary files via an absolute pathname in the this_file parameter.  NOTE: traversal via a .. (dot dot) is probably also possible."
    },
    {
      "lang": "es",
      "value": "Vulnerabilidad de salto de directorio absoluto en adm/file.cgi en la video cámara inalámbrica  Cisco Linksys WVC54GCA con firmware v1.00R24 y posiblemente v1.00R22, permite a atacantes remoto leer archivos de su elección a través de una ruta absoluta en el parámetro \"this_file\". NOTA: es posible que el salto de directorio se pueda realizar a través de la secuencia .. (punto punto)."
    }
  ],
  "lastModified": "2026-06-16T23:07:31.403",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:h:cisco:wvc54gca:1.00r22:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "69B11DD9-A05C-4209-8EEF-60330E2B31DA"
            },
            {
              "criteria": "cpe:2.3:h:cisco:wvc54gca:1.00r24:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "3EFFA763-8152-4085-A6EE-73F313676289"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}