Linksys E7350 Command Injection Vulnerability in Vif_Disable Function

A command injection vulnerability has been identified in the Linksys E7350 router, specifically in firmware version 1.1.00.032. The issue arises in the '/usr/lib/lua/luci/controller/mtkwifi.lua' file within the 'vif_disable' function, where the 'iface' parameter can be manipulated to inject and execute arbitrary commands.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

To reproduce this vulnerability, send a GET request to the '/cgi-bin/luci/admin/mtk/wifi/vif_disable/' endpoint, including the 'iface' parameter. Inject a command, such as 'ls', into the 'iface' parameter. The injected command will be executed on the device, and the results can be observed in the response.