CVE-2022-43973: Arbitrary code execution in Linksys WRT54GL
An arbitrary code execution vulnerability exisits in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. The CheckTSSI function within the httpd binary uses unvalidated user input in the construction of a system command. An authenticated attacker with administrator privileges can leverage this vulnerability over the network via a malicious POST request to /apply.cgi to execute arbitrary commands on the underlying Linux operating system as root.
Affected Software
Event History
Frequently Asked Questions
What is the vulnerability ID for this vulnerability?
The vulnerability ID for this vulnerability is CVE-2022-43973.
What is the severity of CVE-2022-43973?
The severity of CVE-2022-43973 is high, with a severity value of 7.2.
What is the affected software for CVE-2022-43973?
The affected software for CVE-2022-43973 is Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006.
How does the vulnerability CVE-2022-43973 allow arbitrary code execution?
The vulnerability CVE-2022-43973 allows arbitrary code execution by exploiting the unvalidated user input in the Check_TSSI function within the httpd binary.
Is an attacker required to be authenticated and have administrator privileges to exploit CVE-2022-43973?
Yes, an authenticated attacker with administrator privileges is required to exploit CVE-2022-43973.