Arbitrary code execution in Linksys WUMC710
CVE-2022-43971

7.2HIGH

Key Information:

Vendor

Linksys
Status
Linksys Wumc710 Wireless-ac Universal Media Connector
Vendor
CVE Published:
9 January 2023

What is CVE-2022-43971?

An arbitrary code execution vulnerability is present in the Linksys WUMC710 Wireless-AC Universal Media Connector, specifically in the do_setNTP function of the httpd binary. This vulnerability arises from the use of unvalidated user input for assembling a system command. An attacker with authenticated administrator access can exploit this weakness by sending a malicious GET or POST request to /setNTP.cgi, allowing the execution of arbitrary commands on the device's underlying Linux operating system with root privileges.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

Linksys WUMC710 Wireless-AC Universal Media Connector Firmware <= 1.0.02 (build 3)

References

https://youtu.be/73-1lhvJPNg
https://youtu.be/TeWAmZaKQ_w
https://youtu.be/RfWVYCUBNZ0

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jessie Chick of Trellix ARC
JSON
.