| Titre | Linksys WRT54GL 4.30.18 OS Command Injection (CWE-78) |
|---|
| Description | A command injection vulnerability was discovered in Linksys WRT54GL firmware v4.30.18 (build 006, the latest and final firmware for this end-of-life product). The Ping diagnostic function of the web management interface passes the ping_ip POST parameter of /apply.cgi through an incomplete blacklist filter (validate_xss blocks backticks and script tags but not semicolons, ampersands or $()), stores it in nvram and signals init, where the rc start_ping service handler formats it into a command line via snprintf and executes it with system() as root. The LAN-prefix validation in the service handler is bypassed because sscanf('%d.%d.%d.%d') ignores a trailing ';command' while the first octets still match, and the space filter is bypassed with a tab character. Reproduction: an authenticated request to /apply.cgi with submit_button=Ping, submit_type=start, change_action=gozila_cgi and ping_ip=192.168.1.100%3Btouch%09pwned executes the injected command with root privileges (verified dynamically against the stock firmware binaries; an empty marker file was created). Successful exploitation grants an authenticated attacker (web admin credentials; the factory default password is well known) full command execution as root on the device. Proposed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2). Discovered by Zimo-666 via static firmware analysis and dynamic emulation. |
|---|
| Utilisateur | liuyingqi (UID 102046) |
|---|
| Soumission | 11/10/2026 04:01 (il y a 27 jours) |
|---|
| Modérer | 04/11/2026 12:39 (24 days later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 431042 [Linksys WRT54GL 4.30.18 Ping Diagnostic apply.cgi system ping_ip élévation de privilèges] |
|---|
| Points | 20 |
|---|