cnvd - cnvd-2019-22778

cnvd-2019-22778

Vulnerability from cnvd

Title: Linksys E1200和E2500操作系统命令注入漏洞（CNVD-2019-22778）

Description:

Belkin Linksys E1200和E2500都是美国贝尔金（Belkin）公司的E系列的无线路由器产品。

使用2.0.09版本固件的Belkin Linksys E1200和使用3.0.04版本固件的Linksys E2500中存在操作系统命令注入漏洞，攻击者可通过发送特制的请求利用该漏洞在系统上执行任意命令。

Severity: 高

Patch Name: Linksys E1200和E2500操作系统命令注入漏洞（CNVD-2019-22778）的补丁

Patch Description:

Belkin Linksys E1200和E2500都是美国贝尔金（Belkin）公司的E系列的无线路由器产品。

使用2.0.09版本固件的Belkin Linksys E1200和使用3.0.04版本固件的Linksys E2500中存在操作系统命令注入漏洞，攻击者可通过发送特制的请求利用该漏洞在系统上执行任意命令。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布了漏洞修复程序，请及时关注更新： https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625

Reference: https://nvd.nist.gov/vuln/detail/CVE-2018-3953

Impacted products

Name
['Belkin Linksys E2500 3.0.04', 'Belkin Linksys E1200 2.0.09']

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-3953",
      "cveUrl": "http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-3953"
    }
  },
  "description": "Belkin Linksys E1200\u548cE2500\u90fd\u662f\u7f8e\u56fd\u8d1d\u5c14\u91d1\uff08Belkin\uff09\u516c\u53f8\u7684E\u7cfb\u5217\u7684\u65e0\u7ebf\u8def\u7531\u5668\u4ea7\u54c1\u3002\n\n\u4f7f\u75282.0.09\u7248\u672c\u56fa\u4ef6\u7684Belkin Linksys E1200\u548c\u4f7f\u75283.0.04\u7248\u672c\u56fa\u4ef6\u7684Linksys E2500\u4e2d\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002",
  "discovererName": "Jared Rittle",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u4e86\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://talosintelligence.com/vulnerability_reports/TALOS-2018-0625",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-22778",
  "openTime": "2019-07-16",
  "patchDescription": "Belkin Linksys E1200\u548cE2500\u90fd\u662f\u7f8e\u56fd\u8d1d\u5c14\u91d1\uff08Belkin\uff09\u516c\u53f8\u7684E\u7cfb\u5217\u7684\u65e0\u7ebf\u8def\u7531\u5668\u4ea7\u54c1\u3002\r\n\r\n\u4f7f\u75282.0.09\u7248\u672c\u56fa\u4ef6\u7684Belkin Linksys E1200\u548c\u4f7f\u75283.0.04\u7248\u672c\u56fa\u4ef6\u7684Linksys E2500\u4e2d\u5b58\u5728\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u901a\u8fc7\u53d1\u9001\u7279\u5236\u7684\u8bf7\u6c42\u5229\u7528\u8be5\u6f0f\u6d1e\u5728\u7cfb\u7edf\u4e0a\u6267\u884c\u4efb\u610f\u547d\u4ee4\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Linksys E1200\u548cE2500\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2019-22778\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Belkin Linksys E2500 3.0.04",
      "Belkin Linksys E1200 2.0.09"
    ]
  },
  "referenceLink": "https://nvd.nist.gov/vuln/detail/CVE-2018-3953",
  "serverity": "\u9ad8",
  "submitTime": "2018-10-24",
  "title": "Linksys E1200\u548cE2500\u64cd\u4f5c\u7cfb\u7edf\u547d\u4ee4\u6ce8\u5165\u6f0f\u6d1e\uff08CNVD-2019-22778\uff09"
}

CVE-2018-3953 (GCVE-0-2018-3953)

Vulnerability from cvelistv5

Published

2018-10-17 02:00

Modified

2024-09-17 02:10

Severity ?

7.2 (High) - CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

CWE

OS Command Injection

Summary

Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal, it enters a code path that continues until it reaches offset 0x0042B5C4 in the 'start_lltd' function. Within the 'start_lltd' function, a 'nvram_get' call is used to obtain the value of the user-controlled 'machine_name' NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed.

References

▼	URL	Tags
	https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625	x_refsource_MISC

Impacted products

Vendor

Product

Version

▼

Linksys

ESeries E1200

Version: Firmware Version 2.0.09

Linksys

ESeries E2500

Version: Firmware Version 3.0.04

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T04:57:24.486Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "ESeries E1200",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "Firmware Version 2.0.09"
            }
          ]
        },
        {
          "product": "ESeries E2500",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "Firmware Version 3.0.04"
            }
          ]
        }
      ],
      "datePublic": "2018-10-16T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the \u0027Router Name\u0027 input field through the web portal is submitted to apply.cgi as the value to the \u0027machine_name\u0027 POST parameter. When the \u0027preinit\u0027 binary receives the SIGHUP signal, it enters a code path that continues until it reaches offset 0x0042B5C4 in the \u0027start_lltd\u0027 function. Within the \u0027start_lltd\u0027 function, a \u0027nvram_get\u0027 call is used to obtain the value of the user-controlled \u0027machine_name\u0027 NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed."
        }
      ],
      "metrics": [
        {
          "cvssV3_0": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "OS Command Injection",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-04-19T18:06:51",
        "orgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
        "shortName": "talos"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "talos-cna@cisco.com",
          "DATE_PUBLIC": "2018-10-16T00:00:00",
          "ID": "CVE-2018-3953",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "ESeries E1200",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Firmware Version 2.0.09"
                          }
                        ]
                      }
                    },
                    {
                      "product_name": "ESeries E2500",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Firmware Version 3.0.04"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Linksys"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the \u0027Router Name\u0027 input field through the web portal is submitted to apply.cgi as the value to the \u0027machine_name\u0027 POST parameter. When the \u0027preinit\u0027 binary receives the SIGHUP signal, it enters a code path that continues until it reaches offset 0x0042B5C4 in the \u0027start_lltd\u0027 function. Within the \u0027start_lltd\u0027 function, a \u0027nvram_get\u0027 call is used to obtain the value of the user-controlled \u0027machine_name\u0027 NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed."
            }
          ]
        },
        "impact": {
          "cvss": {
            "baseScore": 7.2,
            "baseSeverity": "High",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625",
              "refsource": "MISC",
              "url": "https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "b86d76f8-0f8a-4a96-a78d-d8abfc7fc29b",
    "assignerShortName": "talos",
    "cveId": "CVE-2018-3953",
    "datePublished": "2018-10-17T02:00:00Z",
    "dateReserved": "2018-01-02T00:00:00",
    "dateUpdated": "2024-09-17T02:10:47.271Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted