CVE-2004-2507

Vulnerability

Absolute path traversal vulnerability in main.cgi of Linksys WVC11B Wireless-B Internet Video Camera. The next_file parameter accepts an absolute pathname, allowing directory traversal outside the web root. Affected firmware versions are not specified in the available references, but the device is from 2004.

Exploitation

An unauthenticated remote attacker can send a crafted HTTP request to main.cgi with an absolute path in the next_file parameter, e.g., /etc/passwd. No authentication or special network position is required beyond network access to the camera.

Impact

Successful exploitation allows reading arbitrary files from the camera's filesystem, potentially exposing sensitive configuration data, credentials, or other information. This is a confidentiality breach.

Mitigation

No official patch or firmware update has been identified in the available references [1]. The device may be end-of-life. Mitigation includes restricting network access to the camera via firewall rules or placing it on an isolated VLAN.