// For flags

CVE-2022-43973

Arbitrary code execution in Linksys WRT54GL

Severity Score

7.2
*CVSS v3.1

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

3
*Multiple Sources

Exploited in Wild

-
*KEV

Decision

-
*SSVC
Descriptions

An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The Check_TSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request to /apply.cgi to execute arbitrary commands on the underlying Linux operating system as root.

Existe una vulnerabilidad de ejecución de código arbitrario en el router Linksys WRT54GL Wireless-G Broadband con firmware &lt;= 4.30.18.006. La función Check_TSSI dentro del binario httpd utiliza entradas de usuario no validadas en la construcción de un comando del sistema. Un atacante autenticado con privilegios de administrador puede aprovechar esta vulnerabilidad en la red mediante una solicitud POST maliciosa a /apply.cgi para ejecutar comandos arbitrarios en el sistema operativo Linux subyacente como root.

*Credits: Jessie Chick of Trellix ARC
CVSS Scores
Attack Vector
Network
Attack Complexity
Low
Privileges Required
High
User Interaction
None
Scope
Unchanged
Confidentiality
High
Integrity
High
Availability
High
* Common Vulnerability Scoring System
SSVC
  • Decision:-
Exploitation
-
Automatable
-
Tech. Impact
-
* Organization's Worst-case Scenario
Timeline
  • 2022-10-28 CVE Reserved
  • 2023-01-09 CVE Published
  • 2024-08-03 CVE Updated
  • 2024-08-03 First Exploit
  • 2024-08-30 EPSS Updated
  • ---------- Exploited in Wild
  • ---------- KEV Due Date
CWE
  • CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CAPEC
References (3)
URL Tag Source
URL Date SRC
https://youtu.be/73-1lhvJPNg 2024-08-03
https://youtu.be/RfWVYCUBNZ0 2024-08-03
https://youtu.be/TeWAmZaKQ_w 2024-08-03
URL Date SRC
URL Date SRC
Affected Vendors, Products, and Versions
Vendor Product Version Other Status
Vendor Product Version Other Status <-- --> Vendor Product Version Other Status
Linksys
Search vendor "Linksys"
 Wrt54gl Firmware
Search vendor "Linksys" for product "Wrt54gl Firmware"
 <= 4.30.18.006
Search vendor "Linksys" for product "Wrt54gl Firmware" and version " <= 4.30.18.006"
-
Affected
in Linksys
Search vendor "Linksys"
 Wrt54gl
Search vendor "Linksys" for product "Wrt54gl"
--
Safe