SGAI Space1 NAS Command Injection Vulnerability in N1211DS Model

A command injection vulnerability has been identified in the SGAI Space1 NAS N1211DS model, affecting versions through 1.0.915. The issue arises in the gsaiagent component, specifically within the RENAME_FILE, OPERATE_FILE, and NGNIX_UPLOAD functions of the /cgi-bin/JSONAPI file. This vulnerability allows remote attackers to execute arbitrary commands by injecting malicious payloads, potentially leading to unauthorized access and control over the affected NAS device.

Impact

Exploitation of this vulnerability allows for unauthorized remote command execution on the affected NAS device, with the injected commands executed with the highest privileges.

Reproduction

To reproduce this vulnerability, send a request to the /cgi-bin/JSONAPI file using the RENAME_FILE or OPERATE_FILE command interface. Include a file name or directory name that contains malicious commands. The injected commands will be executed on the NAS device, demonstrating the command injection vulnerability.