CRITICAL🇵🇱 Wersja polska

CVE-2022-30105

CVSS 9.8v3.1pub. 2022-05-18upd. 2024-11-21

In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remote command injection vulnerabilities. The following parameters in the [form name] form; [list vulnerable parameters], are not properly sanitized after being submitted to the web interface in a POST request. With specially crafted parameters, it is possible to inject a an OS command which will be executed with root privileges, as the web interface, and all processes on the device, run as root.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Belkin N300

    HW
    Belkin
    wszystkie wersje

  • Belkin N300 Firmware

    OS
    Belkin
    1.00.08
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2013-3091CRITICAL9.8ten sam produkt

An Authentication Bypass vulnerability in Belkin N300 (F7D7301v1) router allows remote attackers to bypass aut...

CVE-2013-3092HIGH8.3ten sam produkt

The Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication and gain privileges via ve...

CVE-2013-3089MEDIUM6.8ten sam produkt

Cross-site request forgery (CSRF) vulnerability in apply.cgi in Belkin N300 (F7D7301v1) router allows remote a...

CVE-2013-3090MEDIUM4.3ten sam produkt

Multiple cross-site scripting (XSS) vulnerabilities in Belkin N300 router allow remote attackers to inject arb...

CVE-2023-27217CRITICAL9.8ten sam vendor

A stack-based buffer overflow in the ChangeFriendlyName() function of Belkin Smart Outlet V2 F7c063 firmware_2...