Wavlink NU516U1 Command Injection Vulnerability in Firewall CGI

A command injection vulnerability has been identified in the Wavlink NU516U1 router, specifically in the firmware version M16U1_V240425. The issue arises in the '/cgi-bin/firewall.cgi' file, within the 'sub_401778' function. The vulnerability is triggered by manipulating the 'dmz_flag' parameter, allowing remote execution of arbitrary commands. This exploit has been publicly disclosed and is available as a proof-of-concept.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/firewall.cgi' with the 'firewall' parameter set to 'DMZ' and the 'dmz_flag' parameter containing the command to be executed. The request can be made using a web browser or a tool like curl, ensuring to include the necessary headers and cookies for authentication.