Arbitrary code execution in Linksys WRT54GL
CVE-2022-43973

7.2HIGH

Key Information:

Vendor

Linksys
Status
Wrt54gl Wireless-g Broadband Router
Vendor
CVE Published:
9 January 2023

What is CVE-2022-43973?

An arbitrary code execution vulnerability has been identified in the Linksys WRT54GL Wireless-G Broadband Router running firmware versions 4.30.18.006 and earlier. This issue arises from the Check_TSSI function within the httpd binary, where unvalidated user input can be manipulated to construct a system command. An authenticated attacker with administrative privileges can exploit this vulnerability by sending a crafted POST request to /apply.cgi. By doing so, they can execute arbitrary commands on the underlying Linux operating system with root privileges, potentially compromising the entire system.

Human OS v1.0:
Ageing Is an Unpatched Zero-Day Vulnerability.

Remediate biological technical debt. Prime Ageing uses 95% high-purity SIRT6 activation to maintain genomic integrity and bolster systemic resilience.

Deploy the Patch

Affected Version(s)

WRT54GL Wireless-G Broadband Router Firmware <= 4.30.18.006

References

https://youtu.be/73-1lhvJPNg
https://youtu.be/TeWAmZaKQ_w
https://youtu.be/RfWVYCUBNZ0

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Jessie Chick of Trellix ARC
JSON
.