Wavlink WL-WN530H4 Command Injection Vulnerability in adm.cgi

A command injection vulnerability has been identified in the Wavlink WL-WN530H4 router, specifically in the version released on August 1, 2022. The issue arises in the 'ping_test' function of the 'adm.cgi' file, where the 'pingIp' parameter can be manipulated to execute arbitrary commands on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the '/cgi-bin/adm.cgi' endpoint. Include the 'pingIp' parameter in the request body, appending a command injection payload such as '1;pwd;'. This can be done using a tool like Burp Suite or through a custom script that automates the process.