PT-2018-13949 · Linksys · Linksys Velop

Publicado 2018-09-19 · Atualizado 2019-10-03 · CVE-2018-17208

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linksys Velop version 1.1.2.187020

Description The issue allows unauthenticated command injection, providing an attacker with full root access. This can be achieved via the "cgi-bin/zbtest.cgi" or "cgi-bin/zbtest2.cgi" API endpoints. The vulnerability occurs because shell metacharacters in the query string are mishandled by the ShellExecute function. For example, the zbtest.cgi?cmd=level&level= substring demonstrates this mishandling. Additionally, this issue can be exploited via CSRF.

Recommendations For Linksys Velop version 1.1.2.187020, as a temporary workaround, consider restricting access to the "cgi-bin/zbtest.cgi" and "cgi-bin/zbtest2.cgi" API endpoints to minimize the risk of exploitation. Avoid using the cmd and level variables in the query string of the affected API endpoints until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Enumeração de Fraquezas

CWE-78

Identificadores relacionados

CVE-2018-17208

Produtos afetados

Linksys Velop

Referências · 3

• 🔥 https://langkjaer.com/velop.html · Exploit
• https://osv.dev/vulnerability/CVE-2018-17208 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2018-17208 · Nota de Segurança