Netgear EX8000 Command Injection Vulnerability in action_wireless Function

A command injection vulnerability has been identified in the Netgear EX8000 router, specifically in version V1.0.0.126. The issue arises in the action_wireless function, where the Iface parameter can be manipulated to inject and execute arbitrary commands.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the device.

Reproduction

The vulnerability can be reproduced by sending a request to the action_wireless function with a crafted Iface parameter that includes the injected commands. This can be done using a variety of tools that allow for HTTP request manipulation, such as curl or Postman.