| 标题 | Linksys E5350 1.0.00.037 Missing Authentication / OS Command Injection (CWE-306 / CWE-78) |
|---|
| 描述 | A missing authentication vulnerability was discovered in Linksys E5350 firmware v1.0.00.037 (latest release; product is end-of-life). While the router is in factory/setup-wizard state (wizard_finish not set: out-of-box or after factory reset, before the owner completes initial setup), the URL /wizard/apply.cgi is served without any authentication and is dispatched by the same 86-entry action table as the authenticated /apply.cgi. This exposes the Diagnostics start_ping/start_traceroute actions, whose ping_ip/traceroute_ip parameters are stored in NVRAM verbatim and executed unsanitized via system() by the diag_pingbutton/diag_tracertbutton services, to unauthenticated remote attackers, yielding root command execution. The service blacklist blocks only space, '|' and '>', so ${IFS} supplies whitespace and multi-command injection works. Reproduction (no credentials): POST /wizard/apply.cgi with submit_button=Diagnostics&submit_type=start_ping&ping_ip=y;cd${IFS}..;cd${IFS}tmp;touch${IFS}e5350_pwned2;y returns HTTP 200 with the Diagnostics page; the injected commands execute (marker file created; the identical chain via the authenticated path was syscall-traced: execve("/bin/sh", {"sh","-c","ping -c 5 -s 64 -o /tmp/ping.log <payload> &"})). Boundary controls: the same POST to /apply.cgi in wizard state returns 302 to index.asp (blocked as designed), and after setup completion /wizard/apply.cgi requires authentication. Proposed CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H (8.8). Discovered by Zimo-666 via firmware rehosting, static reverse engineering and dynamic verification. |
|---|
| 来源 | ⚠️ https://github.com/Zimo-666/E5350-cves/tree/main/01-wizard-preauth-command-injection |
|---|
| 用户 | liuyingqi (UID 102046) |
|---|
| 提交 | 2026-10-11 08時38分 (26 日前) |
|---|
| 管理 | 2026-11-04 12時39分 (24 days later) |
|---|
| 状态 | 已接受 |
|---|
| VulDB条目 | 431044 [Linksys E5350 1.0.00.037 /wizard/apply.cgi system ping_ip/traceroute_ip 权限提升] |
|---|
| 积分 | 20 |
|---|