Russound MBX-PRE-D67F OS Command Injection Vulnerability Allowing Root Command Execution

An OS command injection vulnerability has been identified in Russound MBX-PRE-D67F firmware version 3.1.6. This vulnerability allows unauthenticated attackers to execute arbitrary commands as root by injecting malicious input into the hostname parameter of network configuration requests. The issue arises from inadequate sanitization of special characters used in operating system commands within the network configuration handler, facilitating remote code execution with elevated privileges.

Impact

Exploitation of this vulnerability allows unauthenticated attackers to execute arbitrary commands as root on the affected device.

Reproduction

The vulnerability can be reproduced by sending a specially crafted HTTP request to the device's network configuration interface, injecting malicious commands into the hostname parameter. No authentication is required to perform this action.