Tenda AC18 Command Injection Vulnerability in AdvSetLanip Function

A command injection vulnerability has been identified in the Tenda AC18 router, specifically in the firmware version 15.03.05.19. The issue arises in the '/goform/AdvSetLanip' endpoint, where the 'lanIp' parameter can be manipulated to inject commands. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/AdvSetLanip' endpoint with a payload in the 'lanIp' parameter that includes a command, such as '127.0.0.1; reboot'. After injecting the command, it can be verified by sending a POST request to the '/goform/telnet' endpoint, which will return the output of the executed command.