Unrated

Unauthenticated Command Injection in Prolink PRC2402M mesh.cgi

IdentifiersCVE-2021-35400CWE-78

CVE-2021-35400 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/mesh.cgi CGI handler, specifically the code path reached when the HTTP query parameter page=extender is supplied. In get_extender_page, user-controlled input from the key parameter is incorporated into a shell command without proper validation or neutralization. The code reads QUERY_STRING, extracts parameters via web_get, retrieves lan_ipaddr from NVRAM, concatenates lan_ipaddr with the attacker-controlled key value, formats a command of the form echo -n '%s' | md5sum using sprintf, and executes it via popen. Because shell metacharacters in key are not sanitized, an attacker can break out of the intended command context and inject arbitrary shell commands. The injected commands execute in the security context of root.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows arbitrary command execution as root on the affected router. Because the vulnerable endpoint is reachable without authentication, a remote attacker can fully compromise the device, including modifying configuration, executing system utilities, writing files, and potentially establishing persistence or using the router as a pivot point. The issue is WAN-reachable according to the provided context for unauthenticated Prolink PRC2402M command injection flaws.

Mitigation

If you can’t patch tonight, do this now.

Until patched firmware is deployed, restrict access to the router’s web management interface, especially from untrusted networks and the WAN; disable remote administration if not required; place management behind trusted network boundaries; and monitor for suspicious requests to /cgi-bin/mesh.cgi, particularly GET requests with page=extender and anomalous key values containing shell metacharacters. If compromise is suspected, rotate credentials, review configuration integrity, and reimage or replace the device as appropriate.

Remediation

Patch, then assume compromise.

Apply the vendor fix released by Prolink after the June 2021 disclosure process. Remediation requires correcting mesh.cgi so that attacker-controlled parameters are never passed to a shell interpreter unsafely. Specifically, eliminate shell invocation for MD5 generation where possible, or strictly validate and neutralize all user-controlled input before use; replace unsafe command construction patterns such as sprintf plus popen with safer APIs that do not invoke a shell; and ensure the vulnerable page=extender code path in get_extender_page no longer permits command injection through the key parameter.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

starlabs sgNews

Aug 4, 2021

Identifying Bugs in Router Firmware at Scale with Taint Analysis | STAR Labs

A command injection vulnerability affecting the PROLiNK PRC2402M router.

starlabs sgNews

Jun 10, 2021

(CVE-20221-35400) Prolink PRC2402M mesh.cgi get_extender_page Un-authenticated Command Injection Vulnerability | STAR Labs

An unauthenticated remote code execution vulnerability in the Prolink PRC2402M router's mesh.cgi script caused by unsanitized user input being passed to popen.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity