Web Interface Vulnerability in Linksys E5350 Router

CVE-2022-35572

Summary

A security flaw in the Linksys E5350 WiFi Router allows unauthorized retrieval of sensitive information via the web interface. The /SysInfo.htm URI does not require a session ID, enabling attackers to access critical data, including WPA passwords, SSIDs, and hardware details if remote management is enabled. This vulnerability could be exploited by anyone with internet access to the device, particularly when directly connected to the internet.

References