T0B0Rx0R

**Name of the Vulnerable Software and Affected Versions** Linksys WRT1900ACS version 1.0.3.187766 **Description** An issue exists where an unauthenticated user can access a confidential file `setup.js.localized` at the `/ui/1.0.99.187766/dynamic/js/` endpoint, allowing an attacker to obtain a list of possible default guest network passwords. This list, combined with a random 2-digit number, can be used to brute force access to the router's guest network. **Recommendations** For Linksys WRT1900ACS version 1.0.3.187766, consider restricting access to the `/ui/1.0.99.187766/dynamic/js/` endpoint to prevent unauthorized users from accessing the `setup.js.localized` file until a patch is available. Additionally, changing the default guest network password to a strong, unique password can help mitigate the risk of brute force attacks.

**Name of the Vulnerable Software and Affected Versions** Linksys WRT1900ACS version 1.0.3.187766 **Description** The issue concerns a lack of encryption in storing the user login cookie, specifically the `admin-auth` cookie, which contains the admin password in base64 cleartext. This allows a local attacker to discover the admin password and gain administrative access to the router. An attacker can exploit this by sniffing the network during login or by gaining physical access to the victim's computer soon after an administrative login. **Recommendations** For Linksys WRT1900ACS version 1.0.3.187766, consider changing the admin password regularly and avoiding using the same password across multiple devices as a temporary mitigation measure. Restrict access to the router's administrative interface to minimize the risk of exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.