Main
Vulnerability Database
Exploits
ID:1828 - Exploit for Command injection in Linksys WVBR0-25 - CVE-2017-17411
ID:1828 - Exploit for Command injection in Linksys WVBR0-25 - CVE-2017-17411
Published: March 18, 2020
Vulnerability identifier: #VU12117
Vulnerability risk: High
CVE-ID: CVE-2017-17411
CWE-ID: CWE-77
Exploitation vector: Remote access
Vulnerable software:
Linksys WVBR0-25
Linksys WVBR0-25
Link to public exploit:
Vulnerability description
The vulnerability allows a remote unauthenticated attacker to execute arbitrary code with elevated privileges on the target system.
The weakness exists in the web management portal due to improper validation of user-supplied input in the User-Agent header before the execution of a system call. A remote attacker can submit a specially crafted GET request and execute arbitrary code with root privileges.
Remediation
Update to version 1.0.41.