CVE-2021-25310

Katalog CVE

CVSS 8.8 · High EPSS 4,6%

Kerentanan Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection') pada belkin linksys wrt160nl firmware. Skor CVSS 3.1 8.8 (High) menurut NVD.

Deskripsi (NVD)

The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the ui_language POST parameter to the apply.cgi form endpoint. This occurs in do_upgrade_post in mini_httpd. NOTE: This vulnerability only affects products that are no longer supported by the maintaine

Rincian

Terbit di NVD

2 Februari 2021

Terakhir diubah

17 Juni 2026

Status NVD

Modified

CVSS 3.1

8.8 (High), sumber NVD
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H · uraikan di kalkulator

Jenis kelemahan (CWE)

CWE-78: Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')
CWE-150: Improper Neutralization of Escape, Meta, or Control Sequences

EPSS (30 hari)

4,6% peluang dieksploitasi; lebih tinggi dari 91,5% CVE lain

Produk dan versi terdampak

> Data dari konfigurasi CPE di NVD.

Referensi dan perbaikan

• https://research.nccgroup.com/2021/01/28/technical-advisory-linksys-wrt160nl-authenticated-command-injection-c... exploit · advisory pihak ketiga
• https://research.nccgroup.com/?research=Technical%20advisories advisory pihak ketiga