PT-2022-24226 · Linksys · Linksys Mr8300 Router

Published 2022-08-23 · Updated 2022-08-29 · CVE-2022-38132

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Linksys MR8300 Router version 1.0

Description A command injection issue exists in the Linksys MR8300 router during the registration process for the DDNS Service. An attacker connected to the router's web interface can execute arbitrary OS commands by specifying the username and password. The username and password fields are not properly sanitized and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file on the device.

Recommendations For Linksys MR8300 Router version 1.0, as a temporary workaround, consider disabling the DDNS Service registration functionality until a patch is available. Restrict access to the router's web interface to minimize the risk of exploitation. Avoid using the username and password fields in the affected registration process until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2022-38132

Affected Products

Linksys Mr8300 Router

References · 4

• https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2022-38132 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-38132 · Security Note
• https://t.me/cibsecurity/48626 · Telegram Post