| Título | Linksys WRT54GL 4.30.18 OS Command Injection (CWE-78) |
|---|
| Descrição | A command injection vulnerability was discovered in Linksys WRT54GL firmware v4.30.18 (build 006, the latest and final firmware for this end-of-life product). The Traceroute diagnostic function of the web management interface passes the traceroute_ip POST parameter of /apply.cgi through an incomplete blacklist filter (validate_xss blocks backticks and script tags but not semicolons, ampersands or $()), stores it in nvram and signals init, where the rc start_traceroute service handler requires only that the WAN link is up (the normal operating state), formats the value into a command line via snprintf and executes it with system() as root; a space filter is bypassed with a tab character, and payloads are limited to roughly 30 bytes by an 80-byte command buffer. Reproduction: an authenticated request to /apply.cgi with submit_button=Traceroute, submit_type=start, change_action=gozila_cgi and traceroute_ip=127.0.0.1%3Btouch%09pwned executes the injected command with root privileges (verified dynamically against the stock firmware binaries; an empty marker file was created). Successful exploitation grants an authenticated attacker (web admin credentials; the factory default password is well known) full command execution as root on the device. Proposed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2). Discovered by Zimo-666 via static firmware analysis and dynamic emulation. |
|---|
| Utilizador | liuyingqi (UID 102046) |
|---|
| Submissão | 11/10/2026 04h02 (há 27 dias) |
|---|
| Moderação | 04/11/2026 12h39 (24 days later) |
|---|
| Estado | Aceite |
|---|
| Entrada VulDB | 431043 [Linksys WRT54GL 4.30.18 Traceroute Diagnostic Function apply.cgi system traceroute_ip Elevação de Privilégios] |
|---|
| Pontos | 20 |
|---|