Tenda F453 Command Injection Vulnerability in FormWriteFacMac Function

A command injection vulnerability has been identified in the Tenda F453 router, specifically in version 1.0.0.3. The issue arises in the FormWriteFacMac function within the /goform/WriteFacMac file. The vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'mac' argument in the request. This exploitation is made possible because the 'mac' value is directly inserted into a command and executed via the doSystemCmd function.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the /goform/WriteFacMac endpoint. Include a 'mac' parameter with a crafted value that contains the desired command, such as ';echo "this is a vul";'. The router will execute the injected command.