CVE-2023-31742

HIGH

Linksys WRT54GL Remote Command Execution

Title source: github.com
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2023-31742 has a selected CVSS score of 7.2 (high); EIP currently links 1 catalogued exploit.

Description

There is a command injection vulnerability in the Linksys WRT54GL router with firmware version 4.30.18.006. If an attacker gains web management privileges, they can inject commands into the post request parameters wl_ant, wl_rate, WL_atten_ctl, ttcp_num, ttcp_size in the httpd s Start_EPI() function, thereby gaining shell privileges.

Description source: CVE List

Exploitation context

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 28, 2025 · Source: CVE List

Proofs of concept

1

Catalogued exploits

MetasploitLinksys WRT54GL Remote Command ExecutionMetasploit auxiliary PoCby Michael Messner <devnull@s3cur1ty.de>Not analyzed1 file

Ruby

Metasploit
PoC details

References

3