PT-2019-12359 · Linksys · Linksys Re6300+1

Rodney Beede · Published 2019-07-17 · Updated 2020-08-24 · CVE-2019-11535

Positive Technologies (AI Summary)

CVSS v2.0

10

Critical

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Linksys WiFi extender products (RE6400 and RE6300) versions 1.2.04.022 and earlier

Description The issue concerns unsanitized user input in the web interface, allowing for remote command execution. This enables an attacker to access system OS configurations and commands not intended for use beyond the web UI.

Recommendations For Linksys WiFi extender products (RE6400 and RE6300) versions 1.2.04.022 and earlier, consider disabling remote access to the web interface until a fix is available. Restrict access to system OS configurations and commands to minimize the risk of exploitation.

Fix

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

CVE-2019-11535

Affected Products

Linksys Re6300

Linksys Re6400

References · 3

• https://nvd.nist.gov/vuln/detail/CVE-2019-11535 · Security Note
• https://osv.dev/vulnerability/CVE-2019-11535 · Vendor Advisory
• http://s3.amazonaws.com/downloads.linksys.com/support/assets/releasenotes/Linksys%20RE6300%20RE6400%20Firmware%20Release%20Notes_v1.2.05.001.txt · Note