Wavlink NU516U1 Command Injection Vulnerability in Firewall CGI

A command injection vulnerability has been identified in the Wavlink NU516U1 router, specifically in the M16U1_V240425 version. The issue arises in the 'sub_401B30' function of the '/cgi-bin/firewall.cgi' file, where the 'remoteManagementEnabled' parameter is manipulated, allowing for remote command execution. This vulnerability is publicly exploitable, with an exploit available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/firewall.cgi' with the 'firewall' parameter set to 'websSysFirewall'. Include the 'remoteManagementEnabled' parameter with a payload that, when executed, writes to a file on the device, such as a command to list directory contents.