BroadlinkManager OS Command Injection Vulnerability

A command injection vulnerability has been identified in BroadlinkManager version 5.9.1. This vulnerability allows remote attackers to execute arbitrary operating system commands by exploiting the IP Address parameter in the '/device/ping' endpoint. The issue arises from unsanitized user input being passed to a subprocess call, creating a potential security risk.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the server where BroadlinkManager is running.

Reproduction

To reproduce this vulnerability, send a request to the '/device/ping' endpoint with a crafted IP Address parameter that includes the desired command. The application will execute the command on the server, demonstrating the command injection flaw.