NETGEAR RAX5 Command Injection Vulnerability in WPS PIN Management Function
Vulnerability
A command injection vulnerability has been identified in the NETGEAR RAX5 WiFi Router (AX1600) running firmware version V1.0.2.26. The issue arises in the 'apcli_do_enr_pin_wps' function within the '/usr/lib/lua/luci/controller/mtkwifi.lua' file. The vulnerability is triggered through the 'ifname' parameter, allowing injected commands to be executed on the device.
Impact
Exploitation of this vulnerability allows for arbitrary command execution on the affected device.
Reproduction
To reproduce this vulnerability, send a GET request to the '/cgi-bin/luci/admin/mtk/wifi/apcli_do_enr_pin_wps/' endpoint. Include the 'ifname' parameter with a payload that injects a command, such as 'ls>1.txt'. The injected command will be executed, and the output can be verified by checking the result of the injection.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.