Linksys E5600 Command Injection Vulnerability in Ping Test Function

A command injection vulnerability has been identified in the Linksys E5600 router, specifically in version 1.1.0.26. The issue arises within the Lua runtime file, where the pingTest function can be exploited through the pt['pkgsize'] parameter.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

To reproduce this vulnerability, send a request to the Linksys E5600 router's pingTest function, including a crafted pt['pkgsize'] parameter that exploits the command injection flaw. This can be done using a Lua script or a similar method that interacts with the router's firmware.