D-Link DWR-M961 Command Injection Vulnerability in formLtefotaUpgradeFibocom Endpoint

A command injection vulnerability has been identified in the D-Link DWR-M961 4G LTE router, specifically in firmware version 1.1.47. The issue arises in the '/boafrm/formLtefotaUpgradeFibocom' endpoint, where the 'fota_url' parameter is not properly sanitized before being passed to a system command wrapper. This flaw allows authenticated attackers to inject arbitrary shell commands, which are executed with root privileges on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the router with root privileges.

Reproduction

To reproduce this vulnerability, an authenticated user must send a POST request to the '/boafrm/formLtefotaUpgradeFibocom' endpoint. The request must include a crafted 'fota_url' parameter that contains the command injection payload, such as a URL with appended shell commands. The router's firmware will execute the injected commands with root privileges.