Linksys WRT54GL firmware 4.30.18 has an OS command injection flaw in its traceroute diagnostic that can be exploited remotely, a public exploit exists, and the product is no longer supported, so no vendor fix is listed.
What Is It
The flaw is in the system function of apply.cgi, inside the router's Traceroute Diagnostic Function. If an attacker manipulates the traceroute_ip argument, they can inject operating system commands. NVD classifies the weakness as CWE-77 (Command Injection) and CWE-78 (OS Command Injection).
VulDB, the CNA, scored it as follows:
- CVSS 3.1: 9.1 CRITICAL (
AV:N/AC:L/PR:H/UI:N/S:C/C:H/I:H/A:H) - CVSS 4.0: 8.5 HIGH, with exploit maturity rated Proof-of-Concept
- CVSS 2.0: 8.3 HIGH
NVD lists the record's status as "Deferred."
Why It Matters
The attack works over the network, has low complexity and needs no user interaction. Successful exploitation has high impact on confidentiality, integrity and availability. The CVSS 3.1 scope is "Changed," meaning the impact reaches beyond the vulnerable component itself.
The main limit is that the attack requires high privileges, so the attacker needs administrative-level access to the device's web interface.
According to the CVE description, the exploit has been publicly disclosed and may be used. A public write-up is linked in the references.
This CVE is not in the CISA Known Exploited Vulnerabilities (KEV) catalog. KEV has not confirmed active exploitation, and there is no CISA-mandated required action or due date.
What's Vulnerable
- Vendor: Linksys
- Product: WRT54GL
- Affected version: 4.30.18
- Component: Traceroute Diagnostic Function (
apply.cgi) - CPE:
cpe:2.3:h:linksys:wrt54gl:*:*:*:*:*:*:*:*
The CNA tagged the record "unsupported-when-assigned." This means the product was already out of maintainer support when the CVE was assigned.
Patch Status
No patch or fixed version is listed. The CVE description says the vendor was contacted early about the disclosure and did not respond. The vulnerability only affects products the maintainer no longer supports, so a vendor fix should not be expected.
Because no fix is coming, the affected firmware will stay vulnerable for as long as the device is in service. Owners should consider retiring the device and should restrict access to its administrative interface until they do.