Arbitrary code execution in Linksys WRT54GL

CVE-2022-43973

Summary

An arbitrary code execution vulnerability has been identified in the Linksys WRT54GL Wireless-G Broadband Router running firmware versions 4.30.18.006 and earlier. This issue arises from the Check_TSSI function within the httpd binary, where unvalidated user input can be manipulated to construct a system command. An authenticated attacker with administrative privileges can exploit this vulnerability by sending a crafted POST request to /apply.cgi. By doing so, they can execute arbitrary commands on the underlying Linux operating system with root privileges, potentially compromising the entire system.

References