Tenda CH22 Command Injection Vulnerability in FormWriteFacMac Function

A command injection vulnerability has been identified in the Tenda CH22 router, specifically in version 1.0.0.1. The issue arises in the FormWriteFacMac function within the file /goform/WriteFacMac. The vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'mac' argument in a crafted request. This exploitation is made possible because the 'mac' value is directly inserted into a command and executed via the doSystemCmd function.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the /goform/WriteFacMac endpoint. Include a 'mac' parameter with a value that contains the desired command, such as ';echo hahahahahaha;'. The router will execute the injected command.