Linksys E5600 Command Injection Vulnerability in Email Registration Function

A command injection vulnerability has been identified in the Linksys E5600 router, specifically in version 1.1.0.26. The issue arises within the 'runtime.emailReg' function, where the vulnerability can be exploited by manipulating the 'pt["email"]' parameter.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

To reproduce this vulnerability, send a request to the Linksys E5600 router's email registration function. Include a payload in the 'pt["email"]' parameter that is designed to execute commands on the device. The router must be running firmware version 1.1.0.26 for the vulnerability to be present.