Edimax AC1200 Wave 2 Dual-Band Gigabit Router Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the Edimax AC1200 Wave 2 Dual-Band Gigabit Router, specifically in the BR-6478AC V3 model with firmware version 1.0.15. The vulnerability arises because the 'systype' parameter is not properly sanitized in the 'formDiskFormat' handler, allowing remote authenticated attackers to execute arbitrary commands as root.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device with root privileges.

Reproduction

To reproduce this vulnerability, send a POST request to '/boafrm/formDiskFormat' with the 'systype' parameter set to 'ext2' and the 'partition' parameter set to 'sda1/n echo 123 > /tmp/poc.txt'. This will execute the command 'echo 123' and write the output to a file named 'poc.txt' in the '/tmp' directory.