Linksys E1200/E2500 Web Portal apply.cgi start_lltd machine_name os command injection

Summaryinfo

A vulnerability was found in Linksys E1200 and E2500 and classified as critical. Affected is the function start_lltd of the file apply.cgi of the component Web Portal. Such manipulation of the argument machine_name as part of POST Parameter leads to os command injection. This vulnerability is documented as CVE-2018-3953. The attack can be executed remotely. There is not any exploit available.

Detailsinfo

A vulnerability, which was classified as critical, has been found in Linksys E1200 and E2500 (Router Operating System) (the affected version is unknown). Affected by this issue is the function start_lltd of the file apply.cgi of the component Web Portal. The manipulation of the argument machine_name as part of a POST Parameter leads to a os command injection vulnerability. Using CWE to declare the problem leads to CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. Impacted is confidentiality, integrity, and availability. CVE summarizes:

Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal, it enters a code path that continues until it reaches offset 0x0042B5C4 in the 'start_lltd' function. Within the 'start_lltd' function, a 'nvram_get' call is used to obtain the value of the user-controlled 'machine_name' NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed.

The bug was discovered 10/16/2018. The weakness was released 10/17/2018 (Website). The advisory is shared for download at talosintelligence.com. This vulnerability is handled as CVE-2018-3953 since 01/01/2018. The exploitation is known to be easy. The attack may be launched remotely. A simple authentication is needed for exploitation. There are known technical details, but no exploit is available. The MITRE ATT&CK project declares the attack technique as T1202.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

Entries connected to this vulnerability are available at VDB-125698 and VDB-125697. VulDB is the best source for vulnerability data and more expert information about this specific topic.

Productinfo

Type

• Router Operating System

Vendor

• Linksys

Name

• E1200
• E2500

License

• commercial

Website

• Vendor: https://www.linksys.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

VulDB is the best source for vulnerability data and more expert information about this specific topic.

Discussion