CVE-2021-35402 — AI Deep Analysis Summary

🚨 **Essence**: OS Command Injection in ProLink PRC2402M Router. 📉 **Consequences**: Attackers can execute arbitrary system commands, leading to total device compromise, data theft, or network disruption.

🛡️ **Root Cause**: **CWE-78** (OS Command Injection). 💥 **Flaw**: The `ip` parameter is not properly sanitized, allowing malicious input to be interpreted as executable shell commands.

📦 **Affected Product**: ProLink PRC2402M Router (Singapore). 📅 **Vulnerable Versions**: All versions prior to **20190909** (specifically before the 2021-06-13 advisory date).

💀 **Attacker Actions**: Full **Remote Command Execution**. 📂 **Impact**: Can read/modify sensitive data, install backdoors, pivot to internal networks, or take down the router completely.

⚡ **Exploitation Threshold**: **LOW**. 🌐 **Auth**: None required (PR:N). 🖱️ **UI**: None required (UI:N). 🎯 **Access**: Network accessible (AV:N). Trivial to exploit remotely.

📜 **Public Exploit**: No specific PoC code provided in data. 🔍 **Reference**: See StarLabs SG Advisory (21-35402) for technical details. ⚠️ **Risk**: High likelihood of wild exploitation due to low barrier.

🔍 **Self-Check**: Scan for ProLink PRC2402M devices. 🧪 **Test**: Inject payloads into the `ip` parameter via network requests. 📊 **Indicator**: Look for command output in responses or side effects (e.g., DNS lookups).

🔧 **Official Fix**: Yes. 📥 **Action**: Update firmware to version **20190909** or later. 🛡️ **Mitigation**: Ensure the `ip` parameter is strictly validated/sanitized against shell metacharacters.

🚧 **No Patch Workaround**: Block external access to the router's management interface. 🚫 **Filter**: Use WAF or firewall rules to block shell injection patterns in the `ip` parameter.…

🔥 **Priority**: **CRITICAL**. 🚨 **Urgency**: Immediate action required. CVSS Score is **High** (9.8+ implied by vector). Remote, unauthenticated, full control risk demands instant patching.