Linksys E5600 Command Injection Vulnerability in DynDNS Function

A command injection vulnerability has been identified in the Linksys E5600 router, specifically in version 1.1.0.26. The issue arises within the runtime.ddnsStatus DynDNS function, where the password parameter is vulnerable to injection attacks.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

To reproduce this vulnerability, log into the router's web interface and authenticate using the admin username and a base64-encoded password. After authentication, send a POST request to the '/API/obj' endpoint with a payload that includes a command injection vector in the 'password' field of the 'DdnsP' object. The injected command will be executed on the router. Finally, send a POST request to the '/API/info' endpoint to verify the injection by checking the response for the output of the executed command.