Linksys E1200/E2500 Network Configuration apply.cgi Domain Name os command injection

Summaryinfo

A vulnerability was found in Linksys E1200 and E2500. It has been declared as critical. Affected by this issue is some unknown functionality of the file apply.cgi of the component Network Configuration. Executing a manipulation of the argument Domain Name can lead to os command injection. This vulnerability appears as CVE-2018-3955. The attack may be performed from remote. There is no available exploit.

Detailsinfo

A vulnerability has been found in Linksys E1200 and E2500 (Router Operating System) (version now known) and classified as critical. This vulnerability affects some unknown processing of the file apply.cgi of the component Network Configuration. The manipulation of the argument Domain Name with an unknown input leads to a os command injection vulnerability. The CWE definition for the vulnerability is CWE-78. The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component. As an impact it is known to affect confidentiality, integrity, and availability. CVE summarizes:

An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04). Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send an authenticated HTTP request to trigger this vulnerability. Data entered into the 'Domain Name' input field through the web portal is submitted to apply.cgi as the value to the 'wan_domain' POST parameter. The wan_domain data goes through the nvram_set process described above. When the 'preinit' binary receives the SIGHUP signal it enters a code path that calls a function named 'set_host_domain_name' from its libshared.so shared object.

The bug was discovered 10/16/2018. The weakness was presented 10/17/2018 (Website). The advisory is available at talosintelligence.com. This vulnerability was named CVE-2018-3955 since 01/01/2018. The exploitation appears to be easy. The attack can be initiated remotely. Required for exploitation is a single authentication. Technical details are known, but there is no available exploit. This vulnerability is assigned to T1202 by the MITRE ATT&CK project.

There is no information about possible countermeasures known. It may be suggested to replace the affected object with an alternative product.

See VDB-125696 and VDB-125697 for similar entries. If you want to get best quality of vulnerability data, you may have to visit VulDB.

Productinfo

Type

• Router Operating System

Vendor

• Linksys

Name

• E1200
• E2500

License

• commercial

Website

• Vendor: https://www.linksys.com/

CPE 2.3info

• 🔍
• 🔍

CPE 2.2info

• 🔍
• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

If you want to get best quality of vulnerability data, you may have to visit VulDB.

Discussion