CVE-2014-125122

EIP tracks 2 public exploits for CVE-2014-125122. PoCs published by Craig Heffner, including Metasploit module auxiliary/admin/http/linksys_tmunblock_admin_reset_bof.

AI-analyzed exploit summary This exploit targets a stack overflow in WRT120N v1.0.0.7 via a crafted POST request to tmUnblock.cgi, using ROP to overwrite the admin password in memory. The payload is designed to clear the admin password by manipulating memory addresses.

A stack-based buffer overflow vulnerability exists in the tmUnblock.cgi endpoint of the Linksys WRT120N wireless router. The vulnerability is triggered by sending a specially crafted HTTP POST request with an overly long TM_Block_URL parameter to the endpoint. By exploiting this flaw, an unauthenticated remote attacker can overwrite memory in a controlled manner, enabling them to temporarily reset the administrator password of the device to a blank value. This grants unauthorized access to the router’s web management interface without requiring valid credentials.