Wavlink NU516U1 Command Injection Vulnerability in Firewall CGI

A command injection vulnerability has been identified in the Wavlink NU516U1 router, specifically in the M16U1_V240425 firmware version. The issue arises in the '/cgi-bin/firewall.cgi' file, within the 'sub_4016F0' function. The vulnerability is triggered by manipulating the 'del_flag' parameter, which allows for remote execution of commands. This flaw has been publicly disclosed and is actively exploitable.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/firewall.cgi' with the 'firewall' parameter set to 'singlePortForwardDelete' and the 'del_flag' parameter containing the command to be executed. The injected command will be executed with the same privileges as the web server user.