Tenda F451 OS Command Injection Vulnerability in Web Management Interface

An OS command injection vulnerability has been identified in the Tenda F451 wireless router, specifically in the web management interface of firmware versions 1.0.0.7 and 1.0.0.9. The vulnerability arises in the 'formWriteFacMac' function within the '/goform/WriteFacMac' endpoint. Here, the 'mac' parameter can be manipulated to inject shell metacharacters, allowing for remote code execution with root privileges.

Impact

Exploitation of this vulnerability allows for remote code execution with root privileges, leading to full system compromise.

Reproduction

To reproduce this vulnerability, send a POST request to the '/goform/WriteFacMac' endpoint with the 'mac' parameter containing shell metacharacters. The injected commands will be executed with root privileges, allowing for remote code execution on the device.