NETGEAR RAX5 Command Injection Vulnerability in apcli_cancel_wps Function

A command injection vulnerability has been identified in the NETGEAR RAX5 WiFi Router (AX1600) running firmware version V1.0.2.26. The vulnerability arises in the apcli_cancel_wps function, where the ifname parameter is not properly sanitized, allowing for arbitrary command execution.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device.

Reproduction

The vulnerability can be reproduced by sending a GET request to the /cgi-bin/luci/admin/mtk/wifi/apcli_cancel_wps/ endpoint. The ifname parameter can be injected with a command, such as 'ls>111.txt', which will be executed on the device. After the injection, the command execution can be verified by checking the contents of the injected file.