cve/2022/CVE-2022-30105.md

### [CVE-2022-30105](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30105)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

In Belkin N300 Firmware 1.00.08, the script located at /setting_hidden.asp, which is accessible before and after configuring the device, exhibits multiple remote command injection vulnerabilities. The following parameters in the [form name] form; [list vulnerable parameters], are not properly sanitized after being submitted to the web interface in a POST request. With specially crafted parameters, it is possible to inject a an OS command which will be executed with root privileges, as the web interface, and all processes on the device, run as root.

### POC

#### Reference
- https://www.exploitee.rs/index.php/Belkin_N300#Remote_Root

#### Github
No PoCs found on GitHub currently.