Wavlink AC3000 OS Command Injection Vulnerability in adm.cgi sch_reboot() Function

A command injection vulnerability has been identified in the Wavlink AC3000 router, specifically in the adm.cgi file within the sch_reboot() function. This vulnerability allows authenticated users to execute arbitrary commands on the device. The issue arises from improper handling of the restart_min POST parameter, which can be exploited by sending a specially crafted HTTP request. Once exploited, the injected command is executed with the privileges of the user running the web server.

Impact

Exploitation of this vulnerability allows for arbitrary code execution on the affected device.

Reproduction

To reproduce this vulnerability, an authenticated user must send a POST request to the adm.cgi script with the restart_min parameter crafted to include malicious commands. The sch_reboot() function will parse the input and execute the injected command as part of the router's scheduled tasks.