BL-AC2100 Remote Code Execution Vulnerability

A remote code execution vulnerability exists in the BL-AC2100 access point, all versions through 1.0.4. The issue arises from the enable parameter passed to /goform/set_hidessid_cfg, which is not properly validated, allowing attackers to execute arbitrary code.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device.

Reproduction

To reproduce this vulnerability, send a request to the /goform/set_hidessid_cfg endpoint with the enable parameter. The lack of proper input validation in this parameter allows for the execution of arbitrary code on the device.