Belkin F9K1015 Command Injection Vulnerability in formSetWanStatic

A command injection vulnerability has been identified in the Belkin F9K1015 router, specifically in version 1.00.10. The issue arises in the '/goform/formSetWanStatic' function, where the 'm_wan_ipaddr' parameter is processed. The vulnerability allows for remote exploitation by manipulating the 'm_wan_ipaddr' argument, leading to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected router.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/formSetWanStatic' with a crafted 'm_wan_ipaddr' parameter. For command injection, include a command wrapped in backticks, such as a ping command. For the buffer overflow, send a significantly long string that exceeds the buffer's capacity.