// For flags

CVE-2022-43970

Buffer overflow in Linksys WRT54GL

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A stack-based buffer overflow in the Start_EPI function within the httpd binary allows an authenticated attacker with administrator privileges to execute arbitrary commands on the underlying Linux operating system as root. This vulnerablity can be triggered over the network via a malicious POST request to /apply.cgi.

Existe una vulnerabilidad de desbordamiento del búfer en el router Linksys WRT54GL Wireless-G Broadband con firmware &lt;= 4.30.18.006. Un desbordamiento de búfer en la región stack de la memoria en la función Start_EPI dentro del binario httpd permite a un atacante autenticado con privilegios de administrador ejecutar comandos arbitrarios en el sistema operativo Linux subyacente como root. Esta vulnerabilidad se puede activar a través de la red mediante una solicitud POST maliciosa a /apply.cgi.

*Credits: Jessie Chick of Trellix ARC
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-10-28 CVE Reserved
  • 2023-01-09 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-08-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-120: Buffer Copy without Checking Size of Input ('Classic Buffer Overflow')
  • CWE-787: Out-of-bounds Write
CAPEC
References (3)
URL Tag Source
URL Date SRC
https://youtu.be/73-1lhvJPNg 2024-08-03
https://youtu.be/RfWVYCUBNZ0 2024-08-03
https://youtu.be/TeWAmZaKQ_w 2024-08-03
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linksys
Search vendor "Linksys"
 Wrt54gl Firmware
Search vendor "Linksys" for product "Wrt54gl Firmware"
 <= 4.30.18.006
Search vendor "Linksys" for product "Wrt54gl Firmware" and version " <= 4.30.18.006"
-
Affected
in Linksys
Search vendor "Linksys"
 Wrt54gl
Search vendor "Linksys" for product "Wrt54gl"
--
Safe