CVE-2022-43971

Arbitrary code execution in Linksys WUMC710

Severity Score

7.2

*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious GET or POST request to /setNTP.cgi to execute arbitrary commands on the underlying Linux operating system as root.

Existe una vulnerabilidad de ejecución de código arbitrario en Linksys WUMC710 Wireless-AC Universal Media Connector con firmware <= 1.0.02 (build3). La función do_setNTP dentro del binario httpd utiliza entradas de usuario no validadas en la construcción de un comando del sistema. Un atacante autenticado con privilegios de administrador puede aprovechar esta vulnerabilidad en la red mediante una solicitud GET o POST maliciosa a /setNTP.cgi para ejecutar comandos arbitrarios en el sistema operativo Linux subyacente como root.

*Credits: Jessie Chick of Trellix ARC

CVSS Scores

NISTv3.1 7.2

Attack Vector

Network

Attack Complexity

Low

Privileges Required

High

User Interaction

None

Scope

Unchanged

Confidentiality

High

Integrity

High

Availability

High

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2022-10-28 CVE Reserved
2023-01-09 CVE Published
2024-08-03 CVE Updated
2024-08-03 First Exploit
2024-09-13 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

CAPEC

References (3)

URL	Tag	Source

URL	Date	SRC
https://youtu.be/73-1lhvJPNg	2024-08-03
https://youtu.be/RfWVYCUBNZ0	2024-08-03
https://youtu.be/TeWAmZaKQ_w	2024-08-03

URL	Date	SRC

URL	Date	SRC

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Linksys Search vendor "Linksys"	Wumc710 Firmware Search vendor "Linksys" for product "Wumc710 Firmware"	< 1.0.02 Search vendor "Linksys" for product "Wumc710 Firmware" and version " < 1.0.02"	-	Affected	in	Linksys Search vendor "Linksys"	Wumc710 Search vendor "Linksys" for product "Wumc710"	-	-	Safe
Linksys Search vendor "Linksys"	Wumc710 Firmware Search vendor "Linksys" for product "Wumc710 Firmware"	1.0.02 Search vendor "Linksys" for product "Wumc710 Firmware" and version "1.0.02"	-	Affected	in	Linksys Search vendor "Linksys"	Wumc710 Search vendor "Linksys" for product "Wumc710"	-	-	Safe
Linksys Search vendor "Linksys"	Wumc710 Firmware Search vendor "Linksys" for product "Wumc710 Firmware"	1.0.02 Search vendor "Linksys" for product "Wumc710 Firmware" and version "1.0.02"	build3	Affected	in	Linksys Search vendor "Linksys"	Wumc710 Search vendor "Linksys" for product "Wumc710"	-	-	Safe