Linksys RE6500 Series Command Injection Vulnerability in RP_checkCredentialsByBBS Function

A critical command injection vulnerability has been identified in Linksys RE6500, RE6250, RE6300, RE6350, RE7000, and RE9000 routers, all running specific firmware versions. The issue arises in the RP_checkCredentialsByBBS function, where the 'pwd' argument can be manipulated to inject operating system commands. This vulnerability can be exploited remotely, and details of the exploit have been made public.

Impact

Exploitation of this vulnerability allows for arbitrary operating system command execution on the affected device.