Linksys E-Series Command Injection Vulnerability in apply.cgi Ping_ip Parameter

A command injection vulnerability has been identified in Linksys E1000 devices running versions prior to 2.1.02, E1200 devices prior to 2.0.05, and E3200 devices running versions prior to 1.0.04. The issue arises in the apply.cgi file, where shell metacharacters in the ping_ip parameter can be exploited to inject and execute operating system commands. This vulnerability is accessible through TCP port 52000.

Impact

Exploitation of this vulnerability allows for OS command injection, where an attacker can execute arbitrary commands on the device's operating system.