WePresent WiPG-1000 Command Injection Vulnerability

A command injection vulnerability has been identified in WePresent WiPG-1000 devices running firmware prior to 2.2.3.0. This vulnerability allows unauthenticated remote attackers to execute arbitrary commands with root privileges on the device. The issue arises from improper input validation in the undocumented '/cgi-bin/rdfs.cgi' endpoint, where the 'Client' parameter is not sanitized before being passed to a system call.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device with root privileges.

Reproduction

To reproduce this vulnerability, send a POST request to the '/cgi-bin/rdfs.cgi' endpoint with a crafted 'Client' parameter that includes the desired command, such as '; reboot;' to demonstrate command execution. The 'Download' parameter must also be included.

Remediation

Users are advised to update to WePresent WiPG-1000 firmware version 2.2.3.0 or later.