CVE-2023-31742
HighCVSS 7.2Exploitation Probability (EPSS)
Very high risk95th percentile - higher than 95% of all known CVEs
Summary
A command injection vulnerability exists in the Linksys WRT54GL router with firmware version 4.30.18.006. An attacker with web management privileges can inject commands into POST request parameters in the httpd's Start_EPI() function, gaining shell access.
Risk Assessment
The risk involves potential full compromise of the router by an attacker with administrative privileges, leading to network security breaches, traffic interception, or further attacks on local network devices.
Recommendation
Immediately update the router firmware to the latest available version if a patch is provided by the vendor. Otherwise, restrict administrative access to trusted IP addresses and consider replacing the device with a newer model that has vendor support.
Original NVD description (English source)
There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.