NETGEAR RAX5 Command Injection Vulnerability in apcli_wps_gen_pincode Function

A command injection vulnerability has been identified in the NETGEAR RAX5 WiFi router, specifically in firmware version V1.0.2.26. The issue arises in the apcli_wps_gen_pincode function, where the ifname parameter can be manipulated to inject arbitrary commands.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the router's operating system.

Reproduction

To reproduce this vulnerability, send a GET request to the '/cgi-bin/luci/admin/mtk/wifi/apcli_wps_gen_pincode/' endpoint. Include the 'ifname' parameter with a payload that injects a command, such as 'ls>1111.txt'. The injected command will be executed, and the output can be verified by checking the result of the injection.