Wavlink WL-WN579A3 Command Injection Vulnerability in Wireless CGI DeleteMac Function

A command injection vulnerability has been identified in the Wavlink WL-WN579A3 router, specifically in versions prior to 20210219. The issue arises in the DeleteMac function within the /cgi-bin/wireless.cgi file, where the delete_list parameter can be manipulated to execute arbitrary commands. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

The vulnerability can be reproduced by sending a POST request to the /cgi-bin/wireless.cgi endpoint with the delete_list parameter. The value of the delete_list parameter can be crafted to include commands that will be executed on the system.