High severity · published Jan 9, 2023
CVE-2022-43970
Buffer overflow in Linksys WRT54GL
7.2
CVSS
19.3%
EPSS
No
On KEV
Description
A buffer overflow vulnerability exists in Linksys WRT54GL Wireless-G Broadband Router with firmware <= 4.30.18.006. A stack-based buffer overflow in the Start_EPI function within the httpd binary allows an authenticated attacker with administrator privileges to execute arbitrary commands on the underlying Linux operating system as root. This vulnerablity can be triggered over the network via a malicious POST request to /apply.cgi.
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
Attack vector
Network
Complexity
Low
Privileges
High
User interaction
None
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)19.3% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
WW
WRT54GL Wireless-G Broadband Router · Linksys
Firmware through 4.30.18.006 · source: vendor
WF
Wrt54gl Firmware · Linksys
through 4.30.18.006 · source: NVD
Affected product
WW
WRT54GL Wireless-G Broadband Router
Linksys
More from WRT54GL Wireless-G Broadband Router
7.5
CVE-2022-43972
Null pointer dereference in Linksys WRT54GL
7.2
CVE-2022-43973
Arbitrary code execution in Linksys WRT54GL