CVE-2018-3953

CWE-78 — OS Command Injection4 documents4 sources
Severity
7.2HIGH
EPSS
68.5%
top 1.39%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
4
Linksys Eseries E1200Linksys Eseries E2500Linksys E1200 Firmware+1 more
Timeline
PublishedOct 17
Latest updateMay 13

Description

Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal, it enters a code path that continues until …

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:HExploitability: 1.2 | Impact: 5.9

Affected Packages4 packages

▶CVEListV5linksys/eseries_e1200Firmware Version 2.0.09
▶CVEListV5linksys/eseries_e2500Firmware Version 3.0.04

🔴Vulnerability Details

2
GHSA
GHSA-frx4-39mr-82xv: Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2↗2022-05-13
▶
CVEList
CVE-2018-3953: Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2↗2018-10-17
▶