| 제목 | Linksys RE7000 v2 2.0.15 Command Injection |
|---|
| 설명 | A vulnerability was found in Linksys RE7000 v2 firmware 2.0.15. The issue affects the /goform/PingTest web management endpoint. The lighttpd configuration rewrites /goform/PingTest to /cgi-bin/json.cgi?PingTest, which is then handled by json.cgi and libcbtjson.so.
Static analysis shows that attacker-controlled PingTest parameters, including pingTestIp, pingTestPktSize and pingTestTimes, can reach the platform_event_pingTest function. Inside this function, the values are used to build a ping command string with snprintf and the resulting command buffer is passed to system. No effective shell metacharacter filtering or strict IP address whitelist was identified for the pingTestIp value.
If an attacker can pass the json.cgi authentication check or obtain a valid session, the issue may allow OS command execution with the privileges of the web management process. The related processes run with high privileges on the embedded Linux system, so successful exploitation may result in full device compromise.
Static evidence includes the /goform to json.cgi rewrite rule, the PingTest handler mapping in libcbtjson.so, the parameter mapping to pingTestIp, pingTestPktSize and pingTestTimes, and the source-to-sink path ending in snprintf followed by system. |
|---|
| 원천 | ⚠️ https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md |
|---|
| 사용자 | sleep (UID 100148) |
|---|
| 제출 | 2026. 07. 27. PM 05:42 (1 월 ago) |
|---|
| 모더레이션 | 2026. 09. 06. PM 06:32 (1 month later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399463 [Linksys RE7000 2.0.15 PingTest json.cgi?PingTest platform_event_pingTest pingTestIp/pingTestPktSize/pingTestTimes 권한 상승] |
|---|
| 포인트들 | 20 |
|---|