Newtec/iDirect OS Command Injection Vulnerability Allowing Local Code Inclusion

A vulnerability allowing improper neutralization of special elements used in OS command execution has been identified in Newtec/iDirect models NTC2218, NTC2250, and NTC2299, running Linux on PowerPC and ARM architectures. This vulnerability, present in versions 1.0.1.1 through 2.2.6.19, arises from the `commit_multicast` page in the modem's web administration interface. The page improperly parses incoming data before passing it to an `eval` statement in a bash script, enabling attackers to inject arbitrary shell commands. Exploitation of this vulnerability could lead to unauthorized code execution on the affected device.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device.