CVE-2022-43971 — Arbitrary code execution in Linksys WUMC710

Description (CNA)

An arbitrary code exection vulnerability exists in Linksys WUMC710 Wireless-AC Universal Media Connector with firmware <= 1.0.02 (build3). The do_setNTP function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious GET or POST request to /setNTP.cgi to execute arbitrary commands on the underlying Linux operating system as root.

Affected (CNA)

Vendor / product	Versions
Linksys / Linksys WUMC710 Wireless-AC Universal Media Connector	affected Firmware through 1.0.02 (build 3)

CWE

CWE-78

References

https://youtu.be/73-1lhvJPNg
https://youtu.be/TeWAmZaKQ_w
https://youtu.be/RfWVYCUBNZ0

ADP enrichment

CVE

No English description supplied.

https://youtu.be/73-1lhvJPNg
https://youtu.be/TeWAmZaKQ_w
https://youtu.be/RfWVYCUBNZ0

CISA-ADP

No English description supplied.

No references supplied.