Unrated

Unauthenticated Command Injection in Prolink PRC2402M mesh.cgi

IdentifiersCVE-2021-35407CWE-78

CVE-2021-35407 is an unauthenticated OS command injection vulnerability in the Prolink PRC2402M router, observed on firmware version 20190909. The flaw is in the /cgi-bin/mesh.cgi CGI handler, specifically the code path reached when the page parameter is set to upgrade. In that path, the get_upgrade_page function reads attacker-controlled parameters including key from the HTTP query string, retrieves lan_ipaddr from NVRAM, and constructs a shell command using sprintf with the format string "echo -n '%s' | md5sum". Because the key parameter is not properly validated or sanitized before being incorporated into the command and executed via popen, an attacker can inject shell metacharacters and execute arbitrary commands. The vulnerable endpoint is reachable over HTTP GET and does not require authentication. Successful exploitation results in arbitrary command execution as root on the affected device.

For your environment

Are you exposed to this one?

Mallory correlates every CVE against your assets, your vendors, and active adversary campaigns. Know which vulnerabilities matter for you, not just which ones are loud.

Start free trial

ANALYST BRIEF

Impact, mitigation & remediation

What it means. What to do now. Patch path, mitigations, and the assume-compromise checklist.

Impact

What an attacker gets, and what they’ve been doing with it.

Successful exploitation allows a remote, unauthenticated attacker to execute arbitrary OS commands on the router with root privileges. This can lead to full device compromise, including modification of configuration, execution of follow-on payloads, persistence, interception or manipulation of network traffic, use of the device as a pivot point, and complete loss of integrity and confidentiality of the appliance.

Mitigation

If you can’t patch tonight, do this now.

Until patched firmware is deployed, restrict access to the router’s web management interface and CGI endpoints, especially from the WAN. Disable remote administration if not required, limit management access to trusted hosts or a dedicated management network, and use firewall or ACL controls to block external access to /cgi-bin/mesh.cgi. Monitor for suspicious requests to /cgi-bin/mesh.cgi with page=upgrade and anomalous shell metacharacters in query parameters such as key. Because exploitation is unauthenticated, exposure of the management interface materially increases risk.

Remediation

Patch, then assume compromise.

Apply the vendor fix released by Prolink. The disclosure timeline in the provided content indicates the issue was reported on 2021-06-10, an initial patch was bypassed on 2021-06-11, and the vulnerability was ultimately fixed on 2021-06-13. Upgrade affected PRC2402M devices to a firmware version containing the final fix. From a secure coding perspective, remediation requires eliminating shell invocation with unsanitized user input, avoiding sprintf-based command construction, and replacing popen-based shell execution with safer APIs and strict input validation.

PUBLIC EXPLOITS

Exploits

No public exploits tracked yet. Mallory keeps watching.

VALID 0 / 0 TOTALView more in app

No public exploit code observed for this vulnerability.

ACTIVITY FEED

Recent activity

2 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.

2 SOURCESView more in app

starlabs sgNews

Aug 4, 2021

Identifying Bugs in Router Firmware at Scale with Taint Analysis | STAR Labs

A command injection vulnerability affecting the PROLiNK PRC2402M router.

starlabs sgNews

Jun 10, 2021

(CVE-20221-35407) Prolink PRC2402M mesh.cgi get_upgrade_page Un-authenticated Command Injection Vulnerability | STAR Labs

An unauthenticated remote code execution vulnerability in the Prolink PRC2402M router's mesh.cgi script, caused by unsanitized user input being passed to popen, allowing arbitrary command execution as root.

What this page doesn’t show

The version that knows your environment.

This page is what’s public. Mallory adds the parts that aren’t: which of your assets are affected, which adversaries are exploiting it right now, which detections to deploy, and what to do tonight.

Start free trial

Exposure mapping

Query your assets running an affected version, and investigate the blast radius.

Threat actor evidence

Every observed campaign linking this CVE to a named adversary.

Associated malware

Malware families riding this exploit, with evidence and IOCs.

Detection signatures

YARA, Sigma, Snort, and vendor rules, auto-deployed to your SIEM.

Vendor-by-vendor mapping

Cross-references every affected SKU, including bundled OEM variants.

Social activity