OS Command Injection Vulnerability in Linksys ESeries Routers

CVE-2018-3954

Summary

Linksys ESeries routers are vulnerable to an OS command injection attack that exploits improper data filtering in the router's web portal. Specifically, the vulnerability allows attackers to manipulate the 'Router Name' input field, sending malicious data to the router's configuration functions via the 'apply.cgi' interface. This can ultimately enable unauthorized access and control over the router's settings, making it imperative for users to apply the necessary updates to secure their devices.

References