ALLNET ALL-RUT22GW OS Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the ALLNET ALL-RUT22GW 4G LTE cellular router, specifically in version 3.3.8. The issue resides in the 'popen.cgi' endpoint, where user-supplied command parameters are executed without proper sanitization, allowing remote attackers to execute arbitrary operating system commands with root privileges. This vulnerability provides complete control over the affected device.

Impact

Exploitation of this vulnerability allows for remote code execution on the affected device with root privileges.

Reproduction

To reproduce this vulnerability, send an unauthenticated HTTP GET request to the 'popen.cgi' endpoint, including a 'command' parameter with the desired OS command. The command will be executed on the device with root privileges, and the response will confirm the execution by returning the command's output.