Linksys RE6500 Series OS Command Injection Vulnerability

A critical OS command injection vulnerability has been identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 routers, all running specific firmware versions. The vulnerability arises in the 'RP_pingGatewayByBBS' function within the '/goform/RP_pingGatewayByBBS' file. It allows remote attackers to inject malicious commands by manipulating the 'ip', 'nm', and 'gw' arguments.

Impact

Exploitation of this vulnerability allows for OS command injection, where an attacker can execute arbitrary commands on the device's operating system.