WR850G wireless router contains a flaw that may allow a remote attacker to log in with administrator access. The issue is triggered when the attacker repeatedly accesses the ver.asp file until a valid administrator logs in from a different IP, at which time the attacker gains administrator access to the device.

Upgrade to version 5.13 or higher, as it has been reported to fix this vulnerability. An upgrade is required as there are no known workarounds.

• Security Tracker: 1011413
• Metasploit ID: 10232
• Bugtraq ID: 11241
• Secunia Advisory ID: 12618
• ISS X-Force ID: 17474
• CVE ID: 2004-1550 (see also: NVD)
• Mail List Post: http://archives.neohapsis.com/archives/fulldisclosure/2004-09/0828.html
  http://lists.grok.org.uk/pipermail/full-disclosure/2004-September/026791.html
  http://marc.theaimsgroup.com/?l=bugtraq&m=109613135105800&w=2
• Vendor URL: http://broadband.motorola.com/consumers/products/wr850g/
  http://www.motorola.com/
• Other Advisory URL: http://www.securiteam.com/securitynews/5IP0O2KE0O.html

• Daniel Fabian - SEC Consult Unternehmensberatung GmbH