Tenda F456 Command Injection Vulnerability in httpd Component

A command injection vulnerability has been identified in the Tenda F456 router, specifically in version 1.0.0.5. The issue arises in the httpd component, within the FromWriteFacMac function of the /goform/WriteFacMac file. The vulnerability allows remote attackers to execute arbitrary operating system commands by manipulating the 'mac' argument in a crafted request.

Impact

Exploitation of this vulnerability allows for command injection, where an attacker can execute arbitrary commands on the router's operating system.

Reproduction

To reproduce this vulnerability, send a POST request to the /goform/WriteFacMac endpoint. Include a 'mac' parameter with a value that contains a command to be executed, such as an echo command. The router will execute the injected command, demonstrating the command injection flaw.