CVE-2013-3568 - Linksys CSRF + Root Command Injection

[vuln-report@xxxxxxxxx]

Hi list,
I would like to inform you that the latest available Linksys WRT110 firmware is 
prone to root shell command injection via cross-site request forgery.  This 
vulnerability is the result of the web interface's failure to sanitize ping 
targets as well as a lack of csrf tokens.  Linksys/Belkin has responded to my 
report to say that the vulnerability is mitigated by a 10 minute idle-timeout 
feature which is available for the admin portal on this device.  It is likely 
that other devices with similar firmware are prone to this as well.

The command execution will not return output but it is possible to direct 
output into files which are available upon subsequent HTTP requests.

This issue was assigned as CVE-2013-3568.

Kind Regards,
Craig Young (@CraigTweets)