Threats tagged 'ghsa-4c6f-v7q4-2m38'

An OS command injection vulnerability exists in various models of E-Series Linksys routers via the /tmUnblock.cgi and /hndUnblock.cgi endpoints over HTTP on port 8080. The vulnerability arises because the CGI scripts improperly process user input passed to the ttcp_ip parameter without sanitization, allowing unauthenticated attackers to inject shell commands. This flaw is actively exploited in the wild by the "TheMoon" worm to deploy a MIPS ELF payload, enabling arbitrary code execution on affected routers. Other Linksys products, including WAG, WAP, WES, WET, WRT-series routers and Wireless-N access points, may also be affected. No patch or remediation information is currently available.