Insufficient Cookie Encryption on Linksys Router Raises Security Concerns

CVE-2019-7311

Summary

A security issue has been identified in Linksys WRT1900ACS devices where the admin password is stored in cleartext within the 'admin-auth' cookie without proper encryption. This flawed storage mechanism allows local attackers to recover the admin password either by intercepting the network traffic during login or through physical access to the victim's computer shortly after an administrative session. Without adequate protection for sensitive authentication data, the risk of unauthorized administrative access to the router significantly increases.

References