OS Command Injection Vulnerability in Linksys ESeries Routers

CVE-2018-3953

Summary

Linksys ESeries routers have a vulnerability that allows OS command injection through improper filtering of user inputs. Specifically, the issue arises when data entered into the 'Router Name' field via the web portal is mishandled in the backend process. When the 'preinit' binary receives a SIGHUP signal, it processes a user-controlled NVRAM entry that determines the hostname. This value is subsequently executed in a command that writes to a file, posing a significant security risk as it can be leveraged by attackers to execute arbitrary commands on the router.

References