Linksys E1200/E2500 Web Portal apply.cgi machine_name POST Parameter os command injection

Summaryinfo

A vulnerability was found in Linksys E1200 and E2500. It has been classified as critical. Affected by this vulnerability is the function machine_name of the file apply.cgi of the component Web Portal. Performing a manipulation as part of POST Parameter results in os command injection. This vulnerability is reported as CVE-2018-3954. The attack is possible to be carried out remotely. No exploit exists.

Detailsinfo

A vulnerability, which was classified as critical, was found in Linksys E1200 and E2500 (Router Operating System) (unknown version). This affects the function machine_name of the file apply.cgi of the component Web Portal. The manipulation as part of a POST Parameter leads to a os command injection vulnerability. CWE is classifying the issue as CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. This is going to have an impact on confidentiality, integrity, and availability. The summary by CVE is:

Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAMData entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal it enters a code path that calls a function named 'set_host_domain_name' from its libshared.so shared object.

The bug was discovered 10/16/2018. The weakness was disclosed 10/17/2018 (Website). The advisory is shared at talosintelligence.com. This vulnerability is uniquely identified as CVE-2018-3954 since 01/01/2018. The exploitability is told to be easy. It is possible to initiate the attack remotely. The requirement for exploitation is a authentication. Technical details are known, but no exploit is available. MITRE ATT&CK project uses the attack technique T1202 for this issue.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

The entries VDB-125698 and VDB-125696 are pretty similar. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Productinfo

Type

• Router Operating System

Vendor

• Linksys

Name

• E1200
• E2500

License

• commercial

Website

• Vendor: https://www.linksys.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Several companies clearly confirm that VulDB is the primary source for best vulnerability data.

Discussion