Operating System Command Injection in Linksys ESeries Routers

CVE-2018-3955

Summary

An operating system command injection vulnerability exists in the Linksys ESeries line of routers. By providing specially crafted entries in the network configuration settings, an attacker can execute arbitrary system commands on devices such as the Linksys E1200 and E2500. Specifically, this vulnerability can be triggered through an authenticated HTTP request that inputs malicious data into the 'Domain Name' field on the router's web interface. This input is processed in a way that allows the execution of unauthorized commands, potentially giving full control over the affected device.

References