CVE-2020-35714

Name of the Vulnerable Software and Affected Versions Belkin LINKSYS RE6500 versions prior to 1.0.11.001

Description The issue allows remote authenticated users to execute arbitrary commands via the "goform/systemCommand?command=" endpoint in conjunction with the "goform/pingstart" program. This can be exploited by sending a malicious request to the "/goform/systemCommand?command=" endpoint.

Recommendations For versions prior to 1.0.11.001, update to version 1.0.11.001 or later to resolve the issue. As a temporary workaround, consider restricting access to the "goform/systemCommand" endpoint and the "goform/pingstart" program until a patch is applied. Avoid using the command variable in the affected API endpoint until the issue is resolved.