A vulnerability was detected in Linksys RE7000 2.0.15. This affects the function platform_event_pingTest of the file /cgi-bin/json.cgi?PingTest of the component PingTest Handler. The manipulation of the argument pingTestIp/pingTestPktSize/pingTestTimes results in os command injection. The attack can be launched remotely. The exploit is now public and may be used.

A critical OS command injection vulnerability has been identified in the Linksys RE7000 range extender running firmware version 2.0.15. The vulnerability exists in the platform_event_pingTest function accessible via /cgi-bin/json.cgi?PingTest endpoint. Attackers can manipulate the arguments pingTestIp, pingTestPktSize, and pingTestTimes to inject arbitrary OS commands. The attack can be executed remotely without physical access to the device. A public exploit is already available, significantly increasing the risk of active exploitation. The vulnerability affects the PingTest Handler component of the device's CGI interface. Successful exploitation could allow an attacker to execute arbitrary commands on the underlying operating system. Given the public availability of the exploit and the remote attack vector, this is considered a high-severity issue.