Linksys E5600 Command Injection Vulnerability in DynDNS Function

A command injection vulnerability has been identified in the Linksys E5600 router, specifically in version 1.1.0.26. The issue arises within the runtime.ddnsStatus DynDNS function, where the mailex parameter is vulnerable to injection attacks.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

To reproduce this vulnerability, send a request to the router's DynDNS function while including a crafted mailex parameter that injects malicious commands. The router will execute the injected commands, demonstrating the command injection flaw.