Wavlink WL-NU516U1 Command Injection Vulnerability Allowing Remote Code Execution

A command injection vulnerability has been identified in the Wavlink WL-NU516U1 wireless network card, specifically in the M16U1_V240425 firmware version. The issue arises in the function sub_4032E4 within the file /cgi-bin/wireless.cgi. The vulnerability allows remote attackers to execute arbitrary OS commands by manipulating the Guest_ssid parameter. This exploitation is made possible through the device's management interface, which is accessible over the network.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device.

Reproduction

The vulnerability can be reproduced by sending a POST request to /cgi-bin/wireless.cgi with the page parameter set to GuestWifi. The Guest_ssid parameter should be crafted to include the desired command, such as a command to list processes, redirected to a file on the device.