CVE-2020-35713 Command injection in n/a
Remote attackers can execute arbitrary commands or reset passwords on Belkin Linksys RE6500 devices via shell metacharacters in the admin page.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- None listed
What is CVE-2020-35713?
CVE-2020-35713 is a critical command injection vulnerability in Linksys Re6500 Firmware, published on 26 Dec 2020. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
Belkin LINKSYS RE6500 devices before 1.0.012.001 allow remote attackers to execute arbitrary commands or set a new password via shell metacharacters to the goform/setSysAdm page.
Weakness: CWE-78
Which versions are affected by CVE-2020-35713?
It affects 1 product.
Products include Linksys Re6500 Firmware.
How do I fix CVE-2020-35713?
No fix has been published for CVE-2020-35713 yet. Limit exposure of the affected software until one is available.
Upgrade, and pass arguments to programs as a list instead of through a shell. More about Command injection.
Is CVE-2020-35713 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2020-35713 exists.
Public exploit code: 1 Nuclei template and 1 proofs of concept on GitHub.
Other vulnerabilities in Linksys Re6500 Firmware
Sources
Also known as GHSA-8r9p-9pp7-xxpc.