Tenda W20E Command Injection Vulnerability in Debug Configuration Function

A command injection vulnerability has been identified in the Tenda W20E router, specifically in version V15.11.0.6. The issue arises in the formSetDebugCfg function, where the level parameter can be manipulated to execute arbitrary commands. This vulnerability can be exploited by sending a crafted request that includes the malicious command in the level parameter.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the 'goform/formSetDebugCfg' endpoint. Include the 'level' parameter with a value that concatenates a command, such as '1;pwd;', along with the 'enable' and 'module' parameters. The command injection can be verified by executing a command that returns a response, such as 'pwd', which will reveal the current directory on the device.