CVSS: 9.0EPSS: 0%CPEs: 4EXPL: 1CVE-2018-3954
https://notcve.org/view.php?id=CVE-2018-3954
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAMData entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal it enters a code path that calls a function named 'set_host_domain_name' from its libshared.so shared object. Los dispositivos de la línea de routers Linksys ESeries (Linksys E1200 con versión del firmware 2.0.09 y Linksys E2500 con versión del firmware 3.0.04) son susceptibles a vulnerabilidades de inyección de comandos del sistema operativo debido al filtrado incorrecto de datos pasados y recuperados desde los datos NVRAM introducidos en el campo de entrada "Router Name" mediante el portal web y enviados a apply.cgi como el valor del parámetro POST "machine_name". Cuando el binario "preinit" recibe la señal SIGHUP, introduce una ruta de código que llama a una función denominada "set_host_domain_name" desde su objeto compartido en libshared.so. • https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625 • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 9.3EPSS: 1%CPEs: 2EXPL: 1CVE-2018-17208
https://notcve.org/view.php?id=CVE-2018-17208
Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi (scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface). This occurs because shell metacharacters in the query string are mishandled by ShellExecute, as demonstrated by the zbtest.cgi?cmd=level&level= substring. This can also be exploited via CSRF. Los dispositivos de Linksys Velop 1.1.2.187020 permite la inyección de comandos no autenticada, proporcionando a un atacante con acceso root total mediante cgi-bin/zbtest.cgi o cgi-bin/zbtest2.cgi (scripts que se pueden descubrir con binwalk en el firmware, pero no son visibles en la interfaz web). • https://langkjaer.com/velop.html • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 10.0EPSS: 97%CPEs: 2EXPL: 4CVE-2017-17411 – Linksys WVBR0 User-Agent Command Injection Remote Code Execution Vulnerability
https://notcve.org/view.php?id=CVE-2017-17411
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. • https://www.exploit-db.com/exploits/43429 https://www.exploit-db.com/exploits/43363 http://www.securityfocus.com/bid/102212 https://github.com/rapid7/metasploit-framework/pull/9336 https://zerodayinitiative.com/advisories/ZDI-17-973 https://www.thezdi.com/blog/2017/12/13/remote-root-in-directvs-wireless-video-bridge-a-tale-of-rage-and-despair https://raw.githubusercontent.com/rapid7/metasploit-framework/master/modules/exploits/linux/http/linksys_wvbr0_user_agent_exec_noauth.rb • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') •
CVSS: 8.8EPSS: 0%CPEs: 2EXPL: 1CVE-2017-10677
https://notcve.org/view.php?id=CVE-2017-10677
Cross-Site Request Forgery (CSRF) exists on Linksys EA4500 devices with Firmware Version before 2.1.41.164606, as demonstrated by a request to apply.cgi to disable SIP. Existe una vulnerabilidad de tipo Cross-Site Request Forgery (CSRF) en dispositivos Linksys EA4500 con versión de firmware anterior a 2.1.41.164606, tal y como demuestra una petición a apply.cgi para deshabilitar SIP. • https://iscouncil.blogspot.com/2017/08/cross-site-request-forgery.html • CWE-352: Cross-Site Request Forgery (CSRF) •
CVSS: 7.5EPSS: 0%CPEs: 20EXPL: 1CVE-2014-8244
https://notcve.org/view.php?id=CVE-2014-8244
Linksys SMART WiFi firmware on EA2700 and EA3500 devices; before 2.1.41 build 162351 on E4200v2 and EA4500 devices; before 1.1.41 build 162599 on EA6200 devices; before 1.1.40 build 160989 on EA6300, EA6400, EA6500, and EA6700 devices; and before 1.1.42 build 161129 on EA6900 devices allows remote attackers to obtain sensitive information or modify data via a JNAP action in a JNAP/ HTTP request. Linksys SMART WiFi firmware en los dispositivos EA2700 y EA3500; anterior a 2.1.41 build 162351 en los dispositivos E4200v2 y EA4500; anterior a 1.1.41 build 162599 en los dispositivos EA6200; anterior a 1.1.40 build 160989 en los dispositivos EA6300, EA6400, EA6500, y EA6700; y anterior a 1.1.42 build 161129 en los dispositivos EA6900 permite a atacantes remotos obtener información o modificar datos a través de una acción JNAP en una solicitud JNAP/ HTTP. • http://www.kb.cert.org/vuls/id/447516 • CWE-200: Exposure of Sensitive Information to an Unauthorized Actor •