D-Link DWR-M921 Command Injection Vulnerability in Firmware 1.1.50

A command injection vulnerability has been identified in the D-Link DWR-M921 router, specifically in firmware version 1.1.50. The issue arises in the '/boafrm/formLtefotaUpgradeFibocom' endpoint, where the 'fota_url' parameter is not properly sanitized before being passed to a system command wrapper. This flaw allows authenticated attackers to inject arbitrary shell commands, which are executed with root privileges on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the router with root privileges.

Reproduction

To reproduce this vulnerability, an authenticated user must send a POST request to the '/boafrm/formLtefotaUpgradeFibocom' endpoint. The request must include a crafted 'fota_url' parameter that contains the command injection payload, such as a URL followed by a command, like 'http://; ls'. The router's firmware will execute the injected command with root privileges.