CVE-2018-3953
published 2018-10-17CVE-2018-3953: Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command…
PriorityP356high7.2CVSS 3.1
AVNACLPRHUINSUCHIHAH
EXPLOIT
EPSS
13.51%
96.2th percentile
Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal, it enters a code path that continues until it reaches offset 0x0042B5C4 in the 'start_lltd' function. Within the 'start_lltd' function, a 'nvram_get' call is used to obtain the value of the user-controlled 'machine_name' NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed.
Affected
4 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| linksys | e1200_firmware | — | — |
| linksys | e2500_firmware | — | — |
| linksys | eseries_e1200 | — | — |
| linksys | eseries_e2500 | — | — |
Detection & IOCsextracted from sources · hover to see the quote
- →Exploit is authenticated; look for authenticated POST requests to apply.cgi on Linksys E-Series devices, especially from unexpected source IPs. Default credentials admin/admin or admin/password are commonly used. ↗
- →Because this is a blind OS command injection, no command output is returned in the HTTP response. Detect exploitation attempts by monitoring for out-of-band activity (e.g., unexpected ICMP/ping traffic) from the router following a POST to apply.cgi. ↗
- →The injection is triggered post-reboot when preinit processes NVRAM values. Suspicious reboots of Linksys E-Series devices shortly after configuration changes to 'Router Name' or 'Domain Name' fields should be investigated. ↗
- →Also monitor POST requests to apply.cgi for the 'wan_domain' parameter with injection payloads, as CVE-2018-3955 follows the same pattern via the 'Domain Name' field. ↗
- ·Exploitation requires prior authentication to the device's web interface. Unauthenticated attackers cannot directly trigger this vulnerability. ↗
- ·The command injection is only triggered after a device reboot/SIGHUP, not immediately upon the malicious POST request. Detection at POST time alone may miss the actual execution phase. ↗
- ·Snort rule 47133 covers CVE-2018-3953, CVE-2018-3954, and CVE-2018-3955 collectively; additional rules may be released and existing rules are subject to change. ↗
CVSS provenance
nvdv3.17.2HIGHCVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv3.07.2HIGHCVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
nvdv2.09.0CRITICALAV:N/AC:L/Au:S/C:C/I:C/A:C
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
No detection rules found.
Metasploit
Linksys E1500/E2500 apply.cgi Remote Command Injection
metasploit
Linksys E1500/E2500 apply.cgi Remote Command Injection
Linksys E1500/E2500 apply.cgi Remote Command Injection
Some Linksys Routers are vulnerable to an authenticated OS command injection. Default credentials for the web interface are admin/admin or admin/password. Since it is a blind os command injection vulnerability, there is no output for the executed command when using the cmd generic payload. A ping command against a controlled system could be used for testing purposes.
Metasploit
Linksys E1500/E2500 Remote Command Execution
metasploit
Linksys E1500/E2500 Remote Command Execution
Linksys E1500/E2500 Remote Command Execution
Some Linksys Routers are vulnerable to an authenticated OS command injection. Default credentials for the web interface are admin/admin or admin/password. Since it is a blind os command injection vulnerability, there is no output for the executed command. A ping command against a controlled system for can be used for testing purposes.
Talos
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
blogs_talos·2023-08-02
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
## The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
Since the discovery of the widespread VPNFilter malware in 2018 , Cisco Talos researchers have been researching vulnerabilities in small and home office (SOHO) and industrial routers.
During that research, Talos has worked with vendors to report and mitigate these vulnerabilities, totaling 141 advisories covering 289 CVEs across multiple routers.
Talos is highlighting some of the major issues our researchers discovered over the past several years, including vulnerabilities that an attacker could mostly directly access or those an adversary could chain together to gain elevated access to the devices.
There are several Snort rules that can detect possible exploitation of the vulnerabilitie
Talos
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
blogs_talos·2023-08-02
The many vulnerabilities Talos discovered in SOHO and industrial wireless routers post-VPNFilter
- Since the discovery of the widespread VPNFilter malware in 2018, Cisco Talos researchers have been researching vulnerabilities in small and home office (SOHO) and industrial routers.
- During that research, Talos has worked with vendors to report and mitigate these vulnerabilities, totaling 141 advisories covering 289 CVEs across multiple routers.
- Talos is highlighting some of the major issues our researchers discovered over the past several years, including vulnerabilities that an attacker could mostly directly access or those an adversary could chain together to gain elevated access to the devices.
- There are several Snort rules that can detect possible exploitation of the vulnerabilities included in this post.
Small office/home office (SOHO) routers and small-scale industrial rout
Talos
Vulnerability Spotlight: Linksys ESeries Multiple OS Command Injection Vulnerabilities
blogs_talos·2018-10-16·CVSS 7.2
[HIGH] Vulnerability Spotlight: Linksys ESeries Multiple OS Command Injection Vulnerabilities
## Vulnerability Spotlight: Linksys ESeries Multiple OS Command Injection Vulnerabilities
Cisco Talos is disclosing several vulnerabilities in the operating system on the Linksys E Series of routers. Multiple exploitable OS command injection vulnerabilities exist in the Linksys E Series line of routers. An attacker can exploit these bugs by sending an authenticated HTTP request to the network configuration. An attacker could then gain the ability to arbitrarily execute code on the machine. The E Series is a line of routers for small and home offices that contain several features to make them easier to use. The routers are designed to connect home computers, internet-ready TVs, game consoles, smartphones and other Wi-Fi devices. Vulnerability Details TALOS-2018-0625 describes three related
Talos
Vulnerability Spotlight: Linksys ESeries Multiple OS Command Injection Vulnerabilities
blogs_talos·2018-10-16·CVSS 7.2
[HIGH] Vulnerability Spotlight: Linksys ESeries Multiple OS Command Injection Vulnerabilities
Cisco Talos is disclosing several vulnerabilities in the operating system on the Linksys E Series of routers.
Multiple exploitable OS command injection vulnerabilities exist in the Linksys E Series line of routers. An attacker can exploit these bugs by sending an authenticated HTTP request to the network configuration. An attacker could then gain the ability to arbitrarily execute code on the machine.
The E Series is a line of routers for small and home offices that contain several features to make them easier to use. The routers are designed to connect home computers, internet-ready TVs, game consoles, smartphones and other Wi-Fi devices.
Vulnerability Details
TALOS-2018-0625 describes three related vulnerabilities: CVE-2018-3953, CVE-2018-3954 and CVE-2018-3955.
Many of the configur
2018-10-17
Published