RE11S Command Injection Vulnerability in Router via L2TPUserName Parameter

A command injection vulnerability has been identified in the RE11S router, specifically in version 1.11. The issue arises in the setWAN function, where the L2TPUserName parameter can be manipulated to execute arbitrary system commands.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected system.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /goform/setWAN endpoint with a crafted L2TPUserName value that includes newline characters followed by the desired command. The 'wanMode' parameter must also be included in the request.