Linksys EA6500 Firmware vulnerabilities

6 CVEs affecting Linksys EA6500 Firmware, 0 known to be exploited (CISA KEV), with EPSS scores. Latest: CVE-2013-4658, published 2019-10-25.

Highest priority

Known exploited (CISA KEV) first, then by EPSS exploit probability.

CVE-2013-4658, published 2019-10-25. Critical severity, CVSS 9.8. EPSS: 9.3% chance of exploitation in the next 30 days. Linksys EA6500 has SMB Symlink Traversal allowing symbolic links to be created to locations outside of the Samba share.
CVE-2014-8244, published 2014-11-01. High severity, CVSS 7.5. EPSS: 4% chance of exploitation in the next 30 days. Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300,…
CVE-2013-3066, published 2014-09-29. High severity, CVSS 7.1. EPSS: 2.1% chance of exploitation in the next 30 days. Linksys EA6500 with firmware 1.1.28.147876 does not properly restrict access, which allows remote attackers to obtain sensitive information (clients and router configuration) via a request to /JNAP/.
CVE-2013-3064, published 2014-09-29. Medium severity, CVSS 6.8. EPSS: 1.3% chance of exploitation in the next 30 days. Open redirect vulnerability in ui/dynamic/unsecured.html in Linksys EA6500 with firmware 1.1.28.147876 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks…
CVE-2014-8243, published 2014-11-01. Low severity, CVSS 3.3. EPSS: 1.2% chance of exploitation in the next 30 days. Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300,…
CVE-2013-3065, published 2014-09-29. Low severity, CVSS 3.5. EPSS: 0.8% chance of exploitation in the next 30 days. Cross-site scripting (XSS) vulnerability in the Parental Controls section in Linksys EA6500 with firmware 1.1.28.147876 allows remote authenticated users to inject arbitrary web script or HTML via…