LB-LINK BL-AC3600 Command Injection Vulnerability in Password Handler

A critical command injection vulnerability has been identified in LB-LINK BL-AC3600 routers running firmware versions through 1.0.22. The issue arises in the Password Handler component, specifically within the easy_uci_set_option_string_0 function of the lighttpd.cgi file. The vulnerability can be exploited remotely by manipulating the routepwd argument.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a request to the device's lighttpd.cgi file with a crafted routepwd argument that includes malicious commands. This can be done using a simple Python script that automates the process.