PT-2018-2660 · Linksys · Linksys E1200+2

Published 2018-07-09 · Updated 2023-04-26 · CVE-2018-3955

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linksys E1200 version 2.0.09 Linksys E2500 version 3.0.04

Description An operating system command injection exists in the Linksys E-Series line of routers. Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send an authenticated HTTP request to trigger this issue. Data entered into the Domain Name input field through the web portal is submitted to apply.cgi as the value to the wan domain POST parameter. The wan domain data goes through the nvram set process. When the preinit binary receives the SIGHUP signal, it enters a code path that calls a function named set host domain name from its libshared.so shared object.

Recommendations For Linksys E1200 version 2.0.09, consider disabling the set host domain name function until a patch is available. For Linksys E2500 version 3.0.04, restrict access to the apply.cgi endpoint to minimize the risk of exploitation. Avoid using the wan domain parameter in the affected HTTP request until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-01292

CVE-2018-3955

Affected Products

Linksys E1200

Linksys E2500

Libshared.So

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625 · Exploit
• https://osv.dev/vulnerability/CVE-2018-3955 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01292 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2018-3955 · Security Note
• https://checkpoint.com/defense/advisories/public/2019/cpai-2018-1073.html · Note