CVE-2022-24372: Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share

Medium severity · published Apr 27, 2022

CVE-2022-24372

Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share

4.6

CVSS

0.5%

EPSS

On KEV

Description

Linksys MR9600 devices before 2.0.5 allow attackers to read arbitrary files via a symbolic link to the root directory of a NAS SMB share.

CVSS vector

CVSS:3.1/AV:P/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N

Attack vector

Physical

Complexity

Low

Privileges

None

User interaction

None

Confidentiality

High

Integrity

None

Availability

None

Scope

Unchanged

Exploitation

Is it being used?

Exploit prediction (EPSS)0.5% · higher than 41% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

Mr9600 Firmware · Linksys

before 2.0.5 · source: NVD

Affected product

Mr9600 Firmware

Linksys

All Mr9600 Firmware CVEs

References

NVD

https://nvd.nist.gov/vuln/detail/CVE-2022-24372

CVE.org

https://www.cve.org/CVERecord?id=CVE-2022-24372

Product

https://www.linksys.com/de/linksys-dual-band-mesh-wifi-6-router-mr9600/p/p-mr9600/

Product

https://www.linksys.com/mesh-routers/linksys-dual-band-mesh-wifi-6-router-mr9600/p/p-mr9600/

Exploit

https://www.syss.de/fileadmin/dokumente/Publikationen/Advisories/SYSS-2021-046.txt