Help protect my Linksys WRT54G from the "curl" command which bypasses my security settings

Question

It's way too easy to break into my Linksys WRT54G router!
Do you have firmware that will fix this vulnerability?
Instantly bypassing the administrator password, my fifteen-year old
neighbor broke into my Linksys WRT54G router (firmware revision v1.0.0.6)
in ten seconds simply by sending this one "curl" command to it via the
Internet from his home next door!
c:\> curl -d "SecurityMode=0&layout=en" http://192.168.0.1/Security.tri
This kid was kind enough to knock on my door today to tell me to fix it.
I invited him in, and from inside my own house, he showed me the Linksys
WRT54G command above which immediately disabled all my wireless security
WITHOUT him having to enter any password!
He showed me how to disable remote administration but he said the
vulnerability still exists until I get a new router. I can't believe
everyone with a Linksys WRT54G router is throwing it in the garbage.
Where/how can I find a firmware update that protects me from this curl
vulnerability?

Answer 1

To protect your router:
* disable remote management.
* enable WPA2 or WPA with a strong preshared key on the router.
That is essentially all you must do. This protects against the curl problem (from the outside). The benefits of the rest varies:
* set a strong, hard to guess password on the router.
That's always a good idea to prevent some guest coming over, plugging into your network and modifying the router. For that to be relevant the person either needs physical access to your wired LAN or the WPA key.
* disable UPnP
Good idea if you are worried you could install some malware on your computer. UPnP allows to set port forwardings for incoming connections from the internet. It allows a computer to automatically setup the forwarding to make a server accessible in the internet. You'll often need this for gaming. But it obviously can be exploited by malware.
* access server to https instead of http
With WPA in place on the wireless this is only really necessary if you worry about someone gaining physical access to your router. https protects the password transmission to the router. But then, if someone gains physical access to my router I think the protection of my password would be the least of my problems.
* disable wireless access to the router configuration
For this to be effective with WPA in place would require the attacker to crack WPA to get into your WLAN. WPA is considered secure at this time. Anyone cracking WPA with a strong key must have a lot of computing power and a lot of knowledge. I don't know if this setting would really prevent that attacker of gaining full access to the router. This setting may be useful if you have an occasional guest to which you grant wireless access to the internet...
* changing the default IP address from 192.168.1.1 to something else and turning off the DHCP server on the router
With the DHCP server in place changing the IP address is no mean of protection because the DHCP server assigns a correct IP address in your LAN. You have to setup static IP addresses on all computers and devices. However, if someone gained access to your LAN (wireless or wired) all you have to do is wait and listen to the LAN traffic. It usually takes a few seconds until some noisy windows computer will broadcast a message and you have picked up the IP addresses in the LAN
Some more things often mentioned with questionable benefits:
* turn off SSID broadcast
Supposed to make the WLAN "invisible". O.K. It does make it harder for the average Joe to check what WLANs are in the neighborhood and which channels they use to optimize the choice of channels and limit interference. It does also prevent accidental connection attempts. However, with WPA/WPA2 in place the WLAN is protected anyway. Anyone, who really wants to know if there is a network can scan with a wireless card in monitor mode. The SSID is transmitted unencrypted. Plus in average it requires more times and more power (on laptops) to connect to the network as the wireless card must actively try to connect to each configured WLAN on the computer to find out if the network is there or not. With SSID broadcast it simply scans for broadcasts and then knows the network is there...
* wireless MAC address filtering
Supposed to limit the computers which can connect to the WLAN. Only computers with the MAC address on the list can connect. Again, this only prevents accidental connection attempts. MAC addresses are transmitted unencrypted. It is easy to pick them up with a wireless scanner. Thus, for anyone who knew how to crack WPA the MAC address filter list will be the least of problems. Most wireless cards can be configured with any MAC address you like. But the list increases the amount of effort for you to add another wireless computer to your WLAN as you always have to remember to set it up correctly...