Command Injection Vulnerability in Linksys E2000 Router
CVE-2023-31740

7.2HIGH

Key Information:

Vendor
Linksys
Status
E2000 Firmware
Vendor
CVE Published:
23 May 2023

Summary

The Linksys E2000 router, specifically firmware version 1.0.06, is susceptible to a command injection vulnerability within its web management interface. An attacker with access to web management can exploit this flaw by injecting malicious commands into specific post request parameters, including WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface. Successful exploitation grants the attacker shell privileges, posing a significant risk to the device and the network it is connected to.

References

http://linksys.com
https://github.com/D2y6p/CVE/blob/main/Linksys/CVE-2023-3...

CVSS V3.1

Score:
7.2
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
High
User Interaction:
None
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.