CVE-2024-25852

HIGHNuclei

Linksys RE7000 AccessControlList Vulnerability

Title source: VulnCheck
STIX 2.1 vulnerability

Record summary

CVE-2024-25852 has a selected CVSS score of 8.8 (high); EIP currently links 1 Nuclei template.

Description

Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point. An attacker can use the vulnerability to obtain device administrator rights.

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · May 22, 2024 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Nuclei templates
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactTotal

CISA Coordinator · SSVC 2.0.3 · Evaluated Aug 14, 2024 · Source: CVE List

Affected products and versions

2
ProductSourceVersion range

RE7000

Browse Linksys / RE7000
VulnCheckVersion data not supplied

re7000_firmware

Browse linksys / re7000_firmware

Default status: unknown

CVE List2.0.9affected
2.0.11affected
2.0.15affected

Nuclei templates

1
ProjectDiscoveryHIGHLinksys RE7000 - Command Injection

Linksys RE7000 v2.0.9, v2.0.11, and v2.0.15 have a command execution vulnerability in the "AccessControlList" parameter of the access control function point

Impact

An attacker can use the vulnerability to obtain device administrator rights.

Remediation

Apply the latest security patches and updates from the vendor to address this vulnerability.

Authorss4e-io
Template tagscvecve2024unauthinjectionvkevvuln
https://nvd.nist.gov/vuln/detail/CVE-2024-25852 https://github.com/ZackSecurity/VulnerReport/blob/cve/Linksys/1.md https://immense-mirror-b42.notion.site/Linksys-RE7000-command-injection-vulnerability-c1a47abf5e8d4dd0934d20d77da930bd

Source: ProjectDiscovery

References

3