Log in Start free

Vulnerability · Published Jan 9, 2023 · Assigned by trellix

CVE-2022-43970Buffer overflow in Linksys WRT54GL

High 7.2

In plain English

A high-severity buffer overflow in WRT54GL Wireless-G Broadband Router from Linksys. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 19.3% (higher than 97% of all known vulnerabilities).

Severity (CVSS 3.1)7.2High
Exploit odds (30 days)19.3%top 2.6% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known

Official description

A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A stack-based buffer overflow in the Start_EPI function within the httpd binary allows an authenticated attacker with administrator privileges to execute arbitrary commands on the underlying Linux operating system as root. This vulnerablity can be triggered over the network via a malicious POST request to /apply.cgi.

Affected products (as reported)

VendorProductVersions
Linksys WRT54GL Wireless-G Broadband Router Firmware – through 4.30.18.006

Weakness: CWE-120 · Vector: CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

References