PT-2024-3428 · Linksys · Linksys E5600

Published

2024-04-26

·

Updated

2025-06-10

·

CVE-2024-33789

CVSS v2.0

10

Critical

VectorAV:N/AC:L/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions: Linksys E5600 version 1.1.0.26
Description: The issue is related to a command injection vulnerability via the ipurl parameter at the "/API/info" form endpoint. This vulnerability is associated with the lack of neutralization of special elements used in the OS command when processing the ipurl parameter in the runtime.pingTest() function of the Linksys E5600 router's firmware. Exploitation of this issue may allow a remote attacker to execute arbitrary commands.
Recommendations: For Linksys E5600 version 1.1.0.26, as a temporary workaround, consider disabling the runtime.pingTest() function until a patch is available. Restrict access to the "/API/info" form endpoint to minimize the risk of exploitation. Avoid using the ipurl parameter in the affected API endpoint until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Command Injection

Weakness Enumeration

CWE-77

Related Identifiers

BDU:2024-03713
CVE-2024-33789

Affected Products

Linksys E5600