CVE-2021-25310: OS Command Injection
First published: Tue Feb 02 2021(Updated: )
** UNSUPPORTED WHEN ASSIGNED ** The administration web interface on Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices allows remote authenticated attackers to execute system commands with root privileges via shell metacharacters in the ui_language POST parameter to the apply.cgi form endpoint. This occurs in do_upgrade_post in mini_httpd. NOTE: This vulnerability only affects products that are no longer supported by the maintainer
Credit: cve@mitre.org cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Belkin Linksys Wrt160nl Firmware | =1.0.04.002_us_20130619 | |
| Belkin Linksys WRT160NL | ||
| All of | ||
| Belkin Linksys Wrt160nl Firmware | =1.0.04.002_us_20130619 | |
| Belkin Linksys WRT160NL |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the vulnerability ID for this issue?
The vulnerability ID for this issue is CVE-2021-25310.
What is the severity of CVE-2021-25310?
The severity of CVE-2021-25310 is critical with a CVSS score of 8.8.
How can an attacker exploit CVE-2021-25310?
An attacker can exploit CVE-2021-25310 by sending shell metacharacters in the ui_language POST parameter to the apply.cgi form endpoint of the administration web interface.
Which devices are affected by CVE-2021-25310?
Belkin Linksys WRT160NL 1.0.04.002_US_20130619 devices are affected by CVE-2021-25310.
How can I fix CVE-2021-25310?
There is currently no official fix or patch available for CVE-2021-25310. It is recommended to apply security best practices, such as using strong passwords and keeping the device firmware up to date.
- collector/nvd-index
- agent/references
- agent/type
- agent/severity
- agent/weakness
- agent/author
- agent/description
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/tags
- agent/first-publish-date
- agent/event
- agent/last-modified-date
- collector/nvd-api
- source/NVD
- vendor/belkin
- canonical/belkin linksys wrt160nl firmware
- version/belkin linksys wrt160nl firmware/1.0.04.002_us_20130619
- canonical/belkin linksys wrt160nl