CVE-2012-1250

Logitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login access, which allows remote attackers to obtain administrative privileges and modify settings via vectors related to PPPoE authentication.

CVSS v2.0 10.0 HIGH

10.0^/10

CVSS v2.0 : HIGH

Vector : AV:N/AC:L/Au:N/C:C/I:C/A:C

Exploitability : 10.0 / Impact : 10.0

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact COMPLETE

Integrity Impact COMPLETE

Availability Impact COMPLETE

References

Link	Resource
http://jvn.jp/en/jp/JVN85934986/index.html	Third Party Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000051	Third Party Advisory VDB Entry
http://secunia.com/advisories/49289	Broken Link
http://www.logitec.co.jp/info/2012/0516.html	Vendor Advisory
http://www.securityfocus.com/bid/53685	Third Party Advisory VDB Entry
http://jvn.jp/en/jp/JVN85934986/index.html	Third Party Advisory
http://jvndb.jvn.jp/jvndb/JVNDB-2012-000051	Third Party Advisory VDB Entry
http://secunia.com/advisories/49289	Broken Link
http://www.logitec.co.jp/info/2012/0516.html	Vendor Advisory
http://www.securityfocus.com/bid/53685	Third Party Advisory VDB Entry

Configurations

Configuration 1 (hide)

AND

cpe:2.3:a:logitech:lan-w300n\/ru2_firmware:*:*:*:*:*:*:*:*

OR	cpe:2.3:h:logitech:lan-w300n\/r:-:::::::*
	cpe:2.3:h:logitech:lan-w300n\/rs:-:::::::*
	cpe:2.3:h:logitech:lan-w300n\/ru2:-:::::::*

History

No history.

Information

Published : 2012-06-04 17:55

Updated : 2025-04-11 00:51

NVD link : CVE-2012-1250

Mitre link : CVE-2012-1250

CVE.ORG link : CVE-2012-1250

JSON object : View

Products Affected

logitech

lan-w300n\/r
lan-w300n\/ru2
lan-w300n\/rs
lan-w300n\/ru2_firmware

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2012-1250", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 10.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:C/I:C/A:C", "authentication": "NONE", "integrityImpact": "COMPLETE", "accessComplexity": "LOW", "availabilityImpact": "COMPLETE", "confidentialityImpact": "COMPLETE"}, "acInsufInfo": false, "impactScore": 10.0, "baseSeverity": "HIGH", "obtainAllPrivilege": true, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2012-06-04T17:55:01.510", "references": [{"url": "http://jvn.jp/en/jp/JVN85934986/index.html", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000051", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "http://secunia.com/advisories/49289", "tags": ["Broken Link"], "source": "vultures@jpcert.or.jp"}, {"url": "http://www.logitec.co.jp/info/2012/0516.html", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "http://www.securityfocus.com/bid/53685", "tags": ["Third Party Advisory", "VDB Entry"], "source": "vultures@jpcert.or.jp"}, {"url": "http://jvn.jp/en/jp/JVN85934986/index.html", "tags": ["Third Party Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://jvndb.jvn.jp/jvndb/JVNDB-2012-000051", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://secunia.com/advisories/49289", "tags": ["Broken Link"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.logitec.co.jp/info/2012/0516.html", "tags": ["Vendor Advisory"], "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securityfocus.com/bid/53685", "tags": ["Third Party Advisory", "VDB Entry"], "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Logitec LAN-W300N/R routers with firmware before 2.27 do not properly restrict login access, which allows remote attackers to obtain administrative privileges and modify settings via vectors related to PPPoE authentication."}, {"lang": "es", "value": "Los routers Logitec LAN-W300N/R con firmware anterior a v2.27, no restringen el acceso al login, lo que permite a atacantes remotos obtener privilegios administrativos y modificar la configuraci\u00f3n a trav\u00e9s de vectores relacionados con la autenticaci\u00f3n PPPoE."}], "lastModified": "2025-04-11T00:51:21.963", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:logitech:lan-w300n\\/ru2_firmware:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "11484C7F-7C03-4F46-A8B5-93D806004F96", "versionEndExcluding": "2.27"}], "operator": "OR"}, {"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:h:logitech:lan-w300n\\/r:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "6F66BA70-88E7-4567-B283-FE4F8B5098CA"}, {"criteria": "cpe:2.3:h:logitech:lan-w300n\\/rs:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "9D0B570C-E90F-4AE1-80F5-1083DB612F1D"}, {"criteria": "cpe:2.3:h:logitech:lan-w300n\\/ru2:-:*:*:*:*:*:*:*", "vulnerable": false, "matchCriteriaId": "4B47A723-415E-4D41-BDFA-E2640BC69D09"}], "operator": "OR"}], "operator": "AND"}], "sourceIdentifier": "vultures@jpcert.or.jp"}