| 标题 | Linksys WRT54GL 4.30.18 OS Command Injection (CWE-78) |
|---|
| 描述 | A command injection vulnerability was discovered in Linksys WRT54GL firmware v4.30.18 (build 006, the latest and final firmware for this end-of-life product). The Ping diagnostic function of the web management interface passes the ping_ip POST parameter of /apply.cgi through an incomplete blacklist filter (validate_xss blocks backticks and script tags but not semicolons, ampersands or $()), stores it in nvram and signals init, where the rc start_ping service handler formats it into a command line via snprintf and executes it with system() as root. The LAN-prefix validation in the service handler is bypassed because sscanf('%d.%d.%d.%d') ignores a trailing ';command' while the first octets still match, and the space filter is bypassed with a tab character. Reproduction: an authenticated request to /apply.cgi with submit_button=Ping, submit_type=start, change_action=gozila_cgi and ping_ip=192.168.1.100%3Btouch%09pwned executes the injected command with root privileges (verified dynamically against the stock firmware binaries; an empty marker file was created). Successful exploitation grants an authenticated attacker (web admin credentials; the factory default password is well known) full command execution as root on the device. Proposed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2). Discovered by Zimo-666 via static firmware analysis and dynamic emulation. |
|---|
| 用户 | liuyingqi (UID 102046) |
|---|
| 提交 | 2026-10-11 04時01分 (26 日前) |
|---|
| 管理 | 2026-11-04 12時39分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 431042 [Linksys WRT54GL 4.30.18 Ping Diagnostic apply.cgi system ping_ip 权限提升] |
|---|
| 积分 | 20 |
|---|