CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 1CVE-2018-3955
https://notcve.org/view.php?id=CVE-2018-3955
An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04). Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send an authenticated HTTP request to trigger this vulnerability. Data entered into the 'Domain Name' input field through the web portal is submitted to apply.cgi as the value to the 'wan_domain' POST parameter. The wan_domain data goes through the nvram_set process described above. • https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.3EPSS: 1%CPEs: 2EXPL: 1CVE-2018-17208
https://notcve.org/view.php?id=CVE-2018-17208
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface). This occurs because shell metacharacters in the query string are mishandled by ShellExecute, as demonstrated by the zbtest.cgi?cmd=level&level= substring. This can also be exploited via CSRF. Los dispositivos de Linksys Velop 1.1.2.187020 permite la inyección de comandos no autenticada, proporcionando a un atacante con acceso root total mediante cgi-bin/zbtest.cgi o cgi-bin/zbtest2.cgi (scripts que se pueden descubrir con binwalk en el firmware, pero no son visibles en la interfaz web). • https://langkjaer.com/velop.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 97%CPEs: 2EXPL: 3CVE-2017-17411 – Linksys WVBR0 User-Agent Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-17411
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. • https://www.exploit-db.com/exploits/43429 https://www.exploit-db.com/exploits/43363 http://www.securityfocus.com/bid/102212 https://github.com/rapid7/metasploit-framework/pull/9336 https://zerodayinitiative.com/advisories/ZDI-17-973 https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-10677
https://notcve.org/view.php?id=CVE-2017-10677
Cross-Site Request Forgery (CSRF) exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP. Existe una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en dispositivos Linksys EA4500 con versión de firmware anterior a 2.1.41.164606, tal y como demuestra una petición a apply.cgi para deshabilitar SIP. • https://iscouncil.blogspot.com/2017/08/cross-site-request-forgery.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 3.3EPSS: 0%CPEs: 20EXPL: 1CVE-2014-8243
https://notcve.org/view.php?id=CVE-2014-8243
Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain the administrator's MD5 password hash via a direct request for the /.htpasswd URI. Linksys SMART WiFi firmware en los dispositivos EA2700 y EA3500; anterior a 2.1.41 build 162351 en los dispositivos E4200v2 y EA4500; anterior a 1.1.41 build 162599 en los dispositivos EA6200; anterior a 1.1.40 build 160989 en los dispositivos EA6300, EA6400, EA6500, y EA6700 devices; y anterior a 1.1.42 build 161129 en los dispositivos EA6900 permite a atacantes remotos obtener el hash de la contraseña MD5 del administrador a través de una solicitud directa para la URI /.htpasswd. • http://www.kb.cert.org/vuls/id/447516 • CWE-310: Cryptographic Issues •