Executive Summary
A vulnerability has been discovered in the Linksys E5600 1.1.0.26 firmware, affecting the init_multipart function in the /cgi-bin/upload_fw.cgi file. This vulnerability allows for a remote out-of-bounds write attack, with a CVSS score of 7.5. The vulnerability is classified as CWE-119 and CWE-787.Technical Analysis
The vulnerability is caused by a lack of proper input validation in the init_multipart function of the /cgi-bin/upload_fw.cgi file. Specifically, the Header Parser component does not correctly handle multipart requests, allowing an attacker to write data out of bounds. This can be exploited remotely, and a proof-of-concept exploit has been made public.How It Gets Exploited
An unauthenticated remote attacker can send a crafted multipart request to the /cgi-bin/upload_fw.cgi endpoint, triggering the out-of-bounds write vulnerability. When the request is processed, the parser fails to validate the input length, causing a buffer overflow that overwrites adjacent memory. This can lead to a denial-of-service (DoS) condition or potentially allow for remote code execution.Impact Assessment
The vulnerability affects Linksys E5600 devices running firmware version 1.1.0.26. Since the device is no longer supported by the maintainer, users are at risk of exploitation. The CVSS score of 7.5 indicates a high severity vulnerability. An attacker can achieve a high impact on availability, potentially leading to a DoS condition.Recommended Actions
Security professionals should:- Update affected Linksys E5600 devices to a supported firmware version, if available.
- Implement network segmentation to isolate affected devices from critical networks.
- Monitor for suspicious traffic to the /cgi-bin/upload_fw.cgi endpoint.
- Consider replacing unsupported devices with supported alternatives.
Sources
- National Vulnerability Database (NVD)
- Vuldb.com
- GitHub repository containing exploit code