CVE-2023-31741
HighCVSS 7.2Exploitation Probability (EPSS)
High risk82th percentile - higher than 82% of all known CVEs
Summary
A command injection vulnerability exists in the Linksys E2000 router with firmware version 1.0.06. An attacker with web management privileges can inject commands into POST request parameters in the httpd Start_EPI() function, gaining shell access.
Risk Assessment
The risk involves potential full compromise of the router by an attacker with administrative privileges, leading to network security breaches, traffic interception, or further attacks on local devices.
Recommendation
Immediately update the router firmware to the latest available version or consider replacing the device with a supported model. If updating is not possible, restrict administrative panel access to trusted IP addresses only.
Other vulnerabilities in Linksys E2000
Original NVD description (English source)
There is a command injection vulnerability in the Linksys E2000 router with firmware version 1.0.06. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ssid, wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.
Vulnerability data from NVD (NIST) · CISA KEV · EPSS