PT-2018-2662 · Linksys · Linksys E1200+1

Published 2018-07-09 · Updated 2023-04-26 · CVE-2018-3953

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linksys E1200 versions 2.0.09 Linksys E2500 versions 3.0.04

Description The issue exists due to improper filtering of data passed to and retrieved from NVRAM, allowing for OS command injection. This can be exploited by a remote attacker to execute arbitrary commands. The vulnerability is triggered when data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the machine name POST parameter. The preinit binary, upon receiving the SIGHUP signal, enters a code path that leads to the start lltd function, where a nvram get call retrieves the user-controlled machine name NVRAM entry. This value is then directly executed in a command intended to write the host name to a file.

Recommendations For Linksys E1200 version 2.0.09, consider disabling the start lltd function until a patch is available. For Linksys E2500 version 3.0.04, restrict access to the apply.cgi endpoint to minimize the risk of exploitation. Avoid using the machine name parameter in the affected API endpoint until the issue is resolved.

Exploit

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

BDU:2019-01294

CVE-2018-3953

Affected Products

Linksys E1200

Linksys E2500

References · 5

• 🔥 https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2018-3953 · Security Note
• https://osv.dev/vulnerability/CVE-2018-3953 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-01294 · Security Note
• https://checkpoint.com/defense/advisories/public/2019/cpai-2018-1073.html · Note