CVE-2023-31740
HighCVSS 7.2Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A command injection vulnerability exists in the Linksys E2000 router with firmware version 1.0.06. An attacker with web management privileges can inject commands into the POST request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.
Risk Assessment
The risk is that an attacker with administrative privileges can gain full control over the router, potentially leading to further attacks within the local network.
Recommendation
It is recommended to immediately update the router firmware to the latest version and restrict administrative panel access to trusted IP addresses only.
Other vulnerabilities in Linksys E2000
Original NVD description (English source)
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters WL_atten_bb, WL_atten_radio, and WL_atten_ctl in the apply.cgi interface, thereby gaining shell privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS