Thecus N4800Eco NAS Command Injection Vulnerability

A command injection vulnerability has been identified in the Thecus N4800Eco NAS Server Control Panel. This vulnerability allows authenticated attackers to execute arbitrary system commands with administrative privileges through user management endpoints. Exploitation involves injecting commands into the username and batch user creation parameters.

Impact

Exploitation of this vulnerability could lead to unauthorized execution of system commands with administrative rights, potentially allowing for further exploitation of the device or its data.

Reproduction

To reproduce this vulnerability, log into the Thecus N4800Eco NAS Server Control Panel as an authenticated user. Once logged in, navigate to the user management section. Inject commands into the username field or the batch user creation parameters. The injected commands will be executed on the system with administrative privileges.