Wavlink WL-WN579A3 Command Injection Vulnerability in Login CGI Script

A command injection vulnerability has been identified in the Wavlink WL-WN579A3 router, specifically in versions prior to 20210219. The issue arises in the CGI login script, where the 'key' parameter can be manipulated to execute arbitrary commands. This vulnerability can be exploited remotely, and a public proof-of-concept exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/login.cgi' with a payload that includes a crafted 'key' parameter. The injected command will be executed on the device, demonstrating the command injection flaw.