CRITICAL🇵🇱 Wersja polska

CVE-2022-30105

CVSS 9.8v3.1pub. 2022-05-18upd. 2024-11-21

In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remote command injection vulnerabilities. The following parameters in the [form name] form; [list vulnerable parameters], are not properly sanitized after being submitted to the web interface in a POST request. With specially crafted parameters, it is possible to inject a an OS command which will be executed with root privileges, as the web interface, and all processes on the device, run as root.

CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

  • Belkin N300

    HW
    Belkin
    all versions

  • Belkin N300 Firmware

    OS
    Belkin
    1.00.08
🔵
CHECK WITH VENDOR
No clear patch data available. Check vendor references.
Tags
Command Injection
CWE
References

Related vulnerabilities

CVE-2013-3091CRITICAL9.8PL ✓same product

Belkin N300 — Authentication Bypass via Javascript Debugging

CVE-2013-3092HIGH8.3same product

The Belkin N300 (F7D7301v1) router allows remote attackers to bypass authentication and gain privileges via ve...

CVE-2013-3089MEDIUM6.8same product

Cross-site request forgery (CSRF) vulnerability in apply.cgi in Belkin N300 (F7D7301v1) router allows remote a...

CVE-2013-3090MEDIUM4.3same product

Multiple cross-site scripting (XSS) vulnerabilities in Belkin N300 router allow remote attackers to inject arb...

CVE-2023-27217CRITICAL9.8PL ✓same vendor

Stack-based buffer overflow w Belkin Smart Outlet V2 F7C063 via UPnP