| Title | Linksys RE7000 v2 2.0.15 Command Injection |
|---|
| Description | A vulnerability was found in Linksys RE7000 v2 firmware 2.0.15. The issue affects the /goform/PingTest web management endpoint. The lighttpd configuration rewrites /goform/PingTest to /cgi-bin/json.cgi?PingTest, which is then handled by json.cgi and libcbtjson.so.
Static analysis shows that attacker-controlled PingTest parameters, including pingTestIp, pingTestPktSize and pingTestTimes, can reach the platform_event_pingTest function. Inside this function, the values are used to build a ping command string with snprintf and the resulting command buffer is passed to system. No effective shell metacharacter filtering or strict IP address whitelist was identified for the pingTestIp value.
If an attacker can pass the json.cgi authentication check or obtain a valid session, the issue may allow OS command execution with the privileges of the web management process. The related processes run with high privileges on the embedded Linux system, so successful exploitation may result in full device compromise.
Static evidence includes the /goform to json.cgi rewrite rule, the PingTest handler mapping in libcbtjson.so, the parameter mapping to pingTestIp, pingTestPktSize and pingTestTimes, and the source-to-sink path ending in snprintf followed by system. |
|---|
| Source | ⚠️ https://github.com/limou89/somevul/blob/main/Linksys_RE7000_v2_PingTest_Command_Injection.md |
|---|
| User | sleep (UID 100148) |
|---|
| Submission | 07/27/2026 17:42 (1 month ago) |
|---|
| Moderation | 09/06/2026 18:32 (1 month later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 399463 [Linksys RE7000 2.0.15 PingTest json.cgi?PingTest platform_event_pingTest pingTestIp/pingTestPktSize/pingTestTimes os command injection] |
|---|
| Points | 20 |
|---|