CVE-2004-2508

Vulnerability

A cross-site scripting (XSS) vulnerability exists in the main.cgi script of the Linksys WVC11B Wireless-B Internet Video Camera. The next_file parameter is not sanitized, allowing injection of arbitrary web script or HTML. This affects all firmware versions of the camera at the time of disclosure [1].

Exploitation

An attacker can exploit this by crafting a malicious URL that includes XSS payload in the next_file parameter. No authentication is required; the victim simply needs to visit the crafted URL while the camera is accessible over the network [1].

Impact

Successful exploitation permits the attacker to execute arbitrary script in the context of the victim's browser, potentially leading to session hijacking, defacement, or theft of sensitive information displayed on the camera interface [1].

Mitigation

Linksys did not release a firmware patch for this vulnerability. The product is likely end-of-life. Users should restrict network access to the camera and avoid clicking untrusted links [1].