Vulnerability Spotlight: Linksys ESeries Multiple OS Command Injection Vulnerabilities
Summary: Cisco Talos disclosed multiple OS command injection vulnerabilities in the Linksys E Series of small-office and home routers, tracked as CVE-2018-3953, CVE-2018-3954 and CVE-2018-3955 under TALOS-2018-0625. An attacker who has already authenticated can send an HTTP request to the network configuration, have data such as the 'machine_name' and 'wan_domain' fields stored in NVRAM, and reach a code path in the 'preinit' binary where that data is passed directly into system commands, allowing arbitrary code execution.
What's compelling: The bugs require prior authentication, but success gives an attacker full control of the device, including installing additional malicious code. Talos points to Mirai and VPNFilter as evidence that SOHO routers are recruited at scale for DDoS and used as an infection vector into targeted organizations, and protection arrives only when the manufacturer ships patched firmware.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2018-3953CVE-2018-3954CVE-2018-3955
- Related
- Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026