Linksys E7350 Command Injection Vulnerability in WPS Pin Generation Function

A command injection vulnerability has been identified in the Linksys E7350 router, specifically in firmware version 1.1.00.032. The issue arises in the 'apcli_wps_gen_pincode' function within the '/usr/lib/lua/luci/controller/mtkwifi.lua' file. The vulnerability is triggered through the 'ifname' parameter, allowing injected commands to be executed on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a GET request to the '/cgi-bin/luci/admin/mtk/wifi/apcli_wps_gen_pincode/' endpoint. The 'ifname' parameter can be injected with a command, such as 'ls>123456.txt', which will be executed on the device. After the injection, the executed command's result can be verified, indicating successful exploitation.