Web Interface Vulnerability in Linksys E5350 Router
CVE-2022-35572

7.5HIGH

Key Information:

Vendor

Linksys
Status
E5350 Firmware
Vendor
CVE Published:
12 September 2022

What is CVE-2022-35572?

A security flaw in the Linksys E5350 WiFi Router allows unauthorized retrieval of sensitive information via the web interface. The /SysInfo.htm URI does not require a session ID, enabling attackers to access critical data, including WPA passwords, SSIDs, and hardware details if remote management is enabled. This vulnerability could be exploited by anyone with internet access to the device, particularly when directly connected to the internet.

References

https://willgu.es/?p=76
x_refsource_MISC

CVSS V3.1

Score:
7.5
Severity:
HIGH
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.