Search

Find a vulnerability

Search criteria

    2 vulnerabilities found for mr8300_firmware by linksys

    CVE-2022-38132 (GCVE-0-2022-38132)

    Vulnerability from nvd – Published: 2022-08-23 23:16 – Updated: 2024-09-16 22:56
    VLAI
    Title
    Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands.
    Summary
    Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file in the device. This issue affects: Linksys MR8300 Router 1.0.
    Severity
    8.2 (High)
    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    CWE
    • CWE-78 - OS Command Injection
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linksys MR8300 Router Affected: Firmware 1.0
    		Create a notification for this product.
    Date Public
    2022-08-23 00:00
    Credits
    Cybellum Technologies LTD.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:45:52.623Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MR8300 Router",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "Firmware 1.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Vulnerable Router connected."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Cybellum Technologies LTD."
        }
      ],
      "datePublic": "2022-08-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router\u0027s web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file in the device. This issue affects: Linksys MR8300 Router 1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-23T23:16:32.000Z",
        "orgId": "24e70c8d-eeca-431d-8285-199a41b4014e",
        "shortName": "Cybellum"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to firmware version 1,1 is available here: https://www.linksys.com/support-article?articleNum=293921"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router\u0027s web interface can execute arbitrary OS commands.",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cybellum.com",
          "DATE_PUBLIC": "2022-08-23T14:10:00.000Z",
          "ID": "CVE-2022-38132",
          "STATE": "PUBLIC",
          "TITLE": "Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router\u0027s web interface can execute arbitrary OS commands."
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MR8300 Router",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "Firmware",
                            "version_value": "1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Linksys"
              }
            ]
          }
        },
        "configuration": [
          {
            "lang": "en",
            "value": "Vulnerable Router connected."
          }
        ],
        "credit": [
          {
            "lang": "eng",
            "value": "Cybellum Technologies LTD."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router\u0027s web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file in the device. This issue affects: Linksys MR8300 Router 1.0."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78 OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt",
              "refsource": "MISC",
              "url": "https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade to firmware version 1,1 is available here: https://www.linksys.com/support-article?articleNum=293921"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "24e70c8d-eeca-431d-8285-199a41b4014e",
    "assignerShortName": "Cybellum",
    "cveId": "CVE-2022-38132",
    "datePublished": "2022-08-23T23:16:32.342Z",
    "dateReserved": "2022-08-10T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:56:38.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

    CVE-2022-38132 (GCVE-0-2022-38132)

    Vulnerability from cvelistv5 – Published: 2022-08-23 23:16 – Updated: 2024-09-16 22:56
    VLAI
    Title
    Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands.
    Summary
    Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router's web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file in the device. This issue affects: Linksys MR8300 Router 1.0.
    Severity
    8.2 (High)
    CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H
    CWE
    • CWE-78 - OS Command Injection
    Assigner
    References
    Impacted products
    Vendor Product Version
    Linksys MR8300 Router Affected: Firmware 1.0
    		Create a notification for this product.
    Date Public
    2022-08-23 00:00
    Credits
    Cybellum Technologies LTD.
    Show details on NVD website
    To clipboard 

    {
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-03T10:45:52.623Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_MISC",
              "x_transferred"
            ],
            "url": "https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "MR8300 Router",
          "vendor": "Linksys",
          "versions": [
            {
              "status": "affected",
              "version": "Firmware 1.0"
            }
          ]
        }
      ],
      "configurations": [
        {
          "lang": "en",
          "value": "Vulnerable Router connected."
        }
      ],
      "credits": [
        {
          "lang": "en",
          "value": "Cybellum Technologies LTD."
        }
      ],
      "datePublic": "2022-08-23T00:00:00.000Z",
      "descriptions": [
        {
          "lang": "en",
          "value": "Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router\u0027s web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file in the device. This issue affects: Linksys MR8300 Router 1.0."
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-78",
              "description": "CWE-78 OS Command Injection",
              "lang": "en",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2022-08-23T23:16:32.000Z",
        "orgId": "24e70c8d-eeca-431d-8285-199a41b4014e",
        "shortName": "Cybellum"
      },
      "references": [
        {
          "tags": [
            "x_refsource_MISC"
          ],
          "url": "https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt"
        }
      ],
      "solutions": [
        {
          "lang": "en",
          "value": "Upgrade to firmware version 1,1 is available here: https://www.linksys.com/support-article?articleNum=293921"
        }
      ],
      "source": {
        "discovery": "EXTERNAL"
      },
      "title": "Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router\u0027s web interface can execute arbitrary OS commands.",
      "x_generator": {
        "engine": "Vulnogram 0.0.9"
      },
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "info@cybellum.com",
          "DATE_PUBLIC": "2022-08-23T14:10:00.000Z",
          "ID": "CVE-2022-38132",
          "STATE": "PUBLIC",
          "TITLE": "Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router\u0027s web interface can execute arbitrary OS commands."
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "MR8300 Router",
                      "version": {
                        "version_data": [
                          {
                            "version_affected": "=",
                            "version_name": "Firmware",
                            "version_value": "1.0"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Linksys"
              }
            ]
          }
        },
        "configuration": [
          {
            "lang": "en",
            "value": "Vulnerable Router connected."
          }
        ],
        "credit": [
          {
            "lang": "eng",
            "value": "Cybellum Technologies LTD."
          }
        ],
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "Command injection vulnerability in Linksys MR8300 router while Registration to DDNS Service. By specifying username and password, an attacker connected to the router\u0027s web interface can execute arbitrary OS commands. The username and password fields are not sanitized correctly and are used as URL construction arguments, allowing URL redirection to an arbitrary server, downloading an arbitrary script file, and eventually executing the file in the device. This issue affects: Linksys MR8300 Router 1.0."
            }
          ]
        },
        "generator": {
          "engine": "Vulnogram 0.0.9"
        },
        "impact": {
          "cvss": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "CHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H",
            "version": "3.1"
          }
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "CWE-78 OS Command Injection"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt",
              "refsource": "MISC",
              "url": "https://downloads.linksys.com/support/assets/releasenotes/MR8300_1.1.10.210186_Customer_ReleaseNotes.txt"
            }
          ]
        },
        "solution": [
          {
            "lang": "en",
            "value": "Upgrade to firmware version 1,1 is available here: https://www.linksys.com/support-article?articleNum=293921"
          }
        ],
        "source": {
          "discovery": "EXTERNAL"
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "24e70c8d-eeca-431d-8285-199a41b4014e",
    "assignerShortName": "Cybellum",
    "cveId": "CVE-2022-38132",
    "datePublished": "2022-08-23T23:16:32.342Z",
    "dateReserved": "2022-08-10T00:00:00.000Z",
    "dateUpdated": "2024-09-16T22:56:38.631Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}