| 제목 | Linksys E5350 1.0.00.037 OS Command Injection (CWE-78) |
|---|
| 설명 | An OS command injection vulnerability was discovered in Linksys E5350 firmware v1.0.00.037 (latest release; product is end-of-life). The Diagnostics page handlers of the embedded CyberTAN httpd store the user-supplied ping_ip and traceroute_ip parameters into NVRAM without any sanitization (handlers at 0x4636f8 and 0x463bb0); the diagnostic service binaries /bin/diag_pingbutton and /bin/diag_tracertbutton then embed the raw value into a shell command executed via system(), allowing an authenticated attacker to execute arbitrary commands as root. The input blacklist blocks only space, '|' and '>'; it does not block ';', '$', '&' or '(', so ${IFS} supplies whitespace and multi-command injection works. A getaddrinfo() pre-check is satisfied with an A record on attacker-controlled DNS (uClibc accepts shell metacharacters in hostnames). Reproduction (authenticated): POST /apply.cgi with submit_button=Diagnostics&submit_type=start_ping&ping_ip=y;cd${IFS}..;cd${IFS}tmp;touch${IFS}e5350_pwned2;y. Runtime evidence: syscall trace of diag_pingbutton shows execve("/bin/sh", {"sh","-c","ping -c 5 -s 64 -o /tmp/ping.log <payload> &"}) and the marker file is created; the traceroute_ip variant injects identically via diag_tracertbutton. Control: a plain IP address yields a normal ping run with no side effects. Chained with the factory-state pre-auth exposure or the empty-password bypass (separate filings), this becomes unauthenticated remote root command execution. Proposed CVSS:3.1/AV:A/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (6.8). Discovered by Zimo-666 via static reverse engineering and dynamic verification with syscall-level evidence. |
|---|
| 원천 | ⚠️ https://github.com/Zimo-666/E5350-cves/tree/main/03-diagnostics-command-injection |
|---|
| 사용자 | liuyingqi (UID 102046) |
|---|
| 제출 | 2026. 10. 11. AM 08:39 (26 날 ago) |
|---|
| 모더레이션 | 2026. 11. 04. PM 12:40 (24 days later) |
|---|
| 상태 | 중복 |
|---|
| VulDB 항목 | 431044 [Linksys E5350 1.0.00.037 /wizard/apply.cgi system ping_ip/traceroute_ip 권한 상승] |
|---|
| 포인트들 | 0 |
|---|