Wavlink WL-WN579A3 Command Injection Vulnerability in Wireless.cgi
Vulnerability
A command injection vulnerability has been identified in the Wavlink WL-WN579A3 router, specifically in versions through 20210219. The issue arises in the Delete_Mac_list function within the /cgi-bin/wireless.cgi file. The vulnerability can be exploited remotely by manipulating the delete_list parameter, allowing for unauthorized command execution on the device.
Impact
Exploitation of this vulnerability allows for arbitrary command execution on the affected device.
Reproduction
To reproduce this vulnerability, send a POST request to the /cgi-bin/wireless.cgi endpoint with the page parameter set to Delete_Mac_list and the delete_list parameter containing the payload for command execution. The device will execute the injected command with system privileges.
Vulnerability Rating
Our algorithm analyzes dozens of metrics to generate these 8 key vulnerability categories, which are then combined to calculate the overall risk score.