Lucene search

MitreCVE-2023-31741

HistoryMay 23, 2023 - 1:15 a.m.

CVE-2023-31741

2023-05-2301:15:10

CWE-77

mitre

web.nvd.nist.gov

cve-2023-31741

command injection

linksys e2000

router

firmware

vulnerability

nvd

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.01

Percentile

83.9%

JSON

There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ssid, wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.

Affected configurations

Nvd

Node

linksyse2000_firmwareMatch1.0.06

AND

linksyse2000Match-

VendorProductVersionCPE
linksyse2000_firmware1.0.06cpe:2.3:o:linksys:e2000_firmware:1.0.06:*:*:*:*:*:*:*
linksyse2000-cpe:2.3:h:linksys:e2000:-:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
linksys	e2000_firmware	1.0.06	cpe:2.3:o:linksys:e2000_firmware:1.0.06:::::::*
linksys	e2000	-	cpe:2.3:h:linksys:e2000:-:::::::*

References

linksys.com

github.com/D2y6p/CVE/blob/main/Linksys/CVE-2023-31741/Linksys_E2000_RCE_2.pdf

CVSS3

7.2

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

HIGH

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H

AI Score

7.3

Confidence

High

EPSS

0.01

Percentile

83.9%

JSON

Related for CVE-2023-31741