CVE-2017-17411
Critical
Description
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.
SeverityCritical
CVSS9.8
Exploit probability—
ProductLinksys Wvbr0 Firmware
PublishedDec 21, 2017
First seenDec 21, 2017
Weakness typeCWE-78OS command injection
How to fix
Update
- linksys wvbr0_firmware1.0.41 or later
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| linksys wvbr0_firmware | v < 1.0.41 | 1.0.41 |
Check your version
Choose the product and enter the version you run to see whether it falls in the affected range.
In the Intelligence 360 plan
Attack Surface Management
See the assets tied to your domains, the technologies they run and known vulnerabilities in one list.