CVEvulnerability
CVE-2017-17411
9.8 CRITICAL
Official page ↗
- Status
- Modified
- Published
- 2017-12-21
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.0 ([email protected])
- 9.8 CRITICAL — CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
- CVSS 2.0 ([email protected])
- 10.0 HIGH — AV:N/AC:L/Au:N/C:C/I:C/A:C
- Weaknesses
- CWE-78
Description
This vulnerability allows remote attackers to execute arbitrary code on vulnerable installations of Linksys WVBR0. Authentication is not required to exploit this vulnerability. The specific flaw exists within the web management portal. The issue lies in the lack of proper validation of user data before executing a system call. An attacker could leverage this vulnerability to execute code with root privileges. Was ZDI-CAN-4892.
Affected configurations
• linksys wvbr0 firmware (< 1.0.41)
Related
Weakness · CWE (1)
- CWE-78 Improper Neutralization of Special Elements used in an OS Command weakness
References
- http://www.securityfocus.com/bid/102212 Third Party Advisory, VDB Entry
- https://github.com/rapid7/metasploit-framework/pull/9336 Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/43363/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/43429/ Exploit, Third Party Advisory, VDB Entry
- https://zerodayinitiative.com/advisories/ZDI-17-973 Third Party Advisory, VDB Entry
- http://www.securityfocus.com/bid/102212 Third Party Advisory, VDB Entry
- https://github.com/rapid7/metasploit-framework/pull/9336 Exploit, Third Party Advisory
- https://www.exploit-db.com/exploits/43363/ Exploit, Third Party Advisory, VDB Entry
- https://www.exploit-db.com/exploits/43429/ Exploit, Third Party Advisory, VDB Entry
- https://zerodayinitiative.com/advisories/ZDI-17-973 Third Party Advisory, VDB Entry