D-Link DWR-M920 Command Injection Vulnerability

A command injection vulnerability has been identified in the D-Link DWR-M920 router, affecting versions through 1.1.50. The issue arises in the 'sub_415328' function within the '/boafrm/formLtefotaUpgradeQuectel' file. The vulnerability allows for remote exploitation by manipulating the 'fota_url' parameter, leading to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/boafrm/formLtefotaUpgradeQuectel' with a crafted 'fota_url' parameter. The first proof-of-concept (poc1) demonstrates a stack overflow by using an excessively long URL. The second proof-of-concept (poc2) shows command injection by including a command in the 'fota_url' parameter, which is executed on the device.