Wavlink AC3000 OS Command Injection Vulnerability in adm.cgi set_ledonoff() Function

A command injection vulnerability has been identified in the Wavlink AC3000 router, specifically in the adm.cgi file within the set_ledonoff() function. This vulnerability allows authenticated attackers to execute arbitrary commands on the device. The issue arises from the way the router's web interface handles HTTP requests, particularly those directed to .cgi scripts.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device.

Reproduction

To reproduce this vulnerability, an authenticated user must send an HTTP POST request to the adm.cgi script with the 'led_cmd' parameter. The request will bypass authentication checks and execute the injected command, leading to command injection on the device.