Wavlink AC3000 Command Injection Vulnerability in Routing Configuration

A command injection vulnerability has been identified in the Wavlink AC3000 router, specifically in the internet.cgi set_add_routing() function. This vulnerability allows authenticated users to execute arbitrary commands on the router by sending specially crafted HTTP requests. The issue arises because the application fails to properly sanitize input from several POST parameters, including 'dest', 'netmask', 'gateway', 'interface', 'custom_interface', and 'comment'. The vulnerability is present in Wavlink AC3000 M33A8.V5030.210505.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, an authenticated user can send a POST request to the 'internet.cgi' script with the 'page' parameter set to 'addrouting'. The 'gateway' POST parameter can be used to inject commands, as the application does not filter the input before executing it. Similar command injection can be achieved through the 'netmask', 'dest', 'custom_interface', and 'comment' parameters.