PT-2026-21285 · Prolink · Prolink Prc2402M

Published 2026-02-20 · Updated 2026-04-11 · CVE-2021-35402

Positive Technologies (AI Summary)

CVSS v3.1

10

Critical

Base vector

AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions PROLiNK PRC2402M versions prior to 2021-06-13

Description The PROLiNK PRC2402M router firmware contains a flaw that allows for arbitrary OS command execution. The issue resides in the live api.cgi script when handling the page=satellite list request. Specifically, the ip parameter within the satellite status function is susceptible to shell metacharacter injection. An attacker can leverage this to execute commands on the device.

Recommendations Update PROLiNK PRC2402M firmware to version 2021-06-13 or later.

Fix

OS Command Injection

Weakness Enumeration

CWE-78

Related Identifiers

CVE-2021-35402

Affected Products

Prolink Prc2402M

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2021-35402 · Security Note
• https://twitter.com/CveTodo/status/2024932156254859461 · Twitter Post
• https://twitter.com/CVEnew/status/2025809082297545059 · Twitter Post
• https://t.me/CVEtracker/45306 · Telegram Post
• https://starlabs.sg/advisories/21/21-35402 · Note
• https://twitter.com/CveFindCom/status/2024932275318665388 · Twitter Post
• https://twitter.com/ctiwatchcloud/status/2042996168045601270 · Twitter Post