| 标题 | Linksys WRT54GL 4.30.18 OS Command Injection (CWE-78) |
|---|
| 描述 | A command injection vulnerability was discovered in Linksys WRT54GL firmware v4.30.18 (build 006, the latest and final firmware for this end-of-life product). The Traceroute diagnostic function of the web management interface passes the traceroute_ip POST parameter of /apply.cgi through an incomplete blacklist filter (validate_xss blocks backticks and script tags but not semicolons, ampersands or $()), stores it in nvram and signals init, where the rc start_traceroute service handler requires only that the WAN link is up (the normal operating state), formats the value into a command line via snprintf and executes it with system() as root; a space filter is bypassed with a tab character, and payloads are limited to roughly 30 bytes by an 80-byte command buffer. Reproduction: an authenticated request to /apply.cgi with submit_button=Traceroute, submit_type=start, change_action=gozila_cgi and traceroute_ip=127.0.0.1%3Btouch%09pwned executes the injected command with root privileges (verified dynamically against the stock firmware binaries; an empty marker file was created). Successful exploitation grants an authenticated attacker (web admin credentials; the factory default password is well known) full command execution as root on the device. Proposed CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (7.2). Discovered by Zimo-666 via static firmware analysis and dynamic emulation. |
|---|
| 用户 | liuyingqi (UID 102046) |
|---|
| 提交 | 2026-10-11 04時02分 (26 日前) |
|---|
| 管理 | 2026-11-04 12時39分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 431043 [Linksys WRT54GL 4.30.18 Traceroute Diagnostic Function apply.cgi system traceroute_ip 权限提升] |
|---|
| 积分 | 20 |
|---|