Linksys Velop Command Injection Vulnerability

Belkin Intermational Linksys Velop is a home WiFi wireless networking solution from Belkin Intermational, USA. A command injection vulnerability exists in Belkin Intermational Linksys Velop version 1.1.2.187020. The vulnerability can be exploited to inject commands and gain full root access with...

CVE-2018-17208

Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface. This occurs because shell...

CVE-2018-17208

Linksys Velop firmware 1.1.2.187020 is affected by an unauthenticated command injection in cgi-bin/zbtest.cgi and cgi-bin/zbtest2.cgi. The root cause is mishandling of shell metacharacters in the query string by ShellExecute, enabling full root access and CSRF exploitation. No patch/version or mi...

PT-2018-13949

Name of the Vulnerable Software and Affected Versions Linksys Velop version 1.1.2.187020 Description The issue allows unauthenticated command injection, providing an attacker with full root access. This can be achieved via the "cgi-bin/zbtest.cgi" or "cgi-bin/zbtest2.cgi" API endpoints. The...

CVE-2018-17208: Improper Neutralization of Special Elements used in an OS Command

Linksys Velop 1.1.2.187020 devices allow unauthenticated command injection, providing an attacker with full root access, via cgi-bin/zbtest.cgi or cgi-bin/zbtest2.cgi scripts that can be discovered with binwalk on the firmware, but are not visible in the web interface. This occurs because shell...