Comfast CF-AC100 Command Injection Vulnerability

A command injection vulnerability exists in the Comfast CF-AC100 access point running firmware version 2.6.0.8. The issue arises in the web management component, specifically within the 'sub_41DBC0' method. The vulnerability allows remote attackers to execute arbitrary commands by sending crafted HTTP POST requests to the '/cgi-bin/mbox-config?method=SET&section=ntp_timezone' endpoint. The 'timestr' parameter is not properly validated, enabling the injection of malicious payloads that are executed on the server.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device.

Reproduction

To reproduce this vulnerability, log into the Comfast CF-AC100 access point and obtain a session cookie. Then, send a POST request to '/cgi-bin/mbox-config?method=SET&section=ntp_timezone' with a JSON payload that includes a crafted 'timestr' value designed to inject and execute commands. The injected commands will be executed with the privileges of the web server user.