Wavlink NU516U1 Command Injection Vulnerability in WiFi Password Change Function

A command injection vulnerability has been identified in the Wavlink NU516U1 USB Network Printer Server, specifically in the M16U1_V240425 firmware. The issue arises in the 'change_wifi_password' function of the '/cgi-bin/adm.cgi' file, where the 'wl_channel', 'wl_Pass', and 'EncrypType' arguments can be manipulated to execute arbitrary operating system commands. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to '/cgi-bin/adm.cgi' with the 'page' parameter set to 'change_wifi_password'. Include the 'wl_channel' parameter with a payload that contains the desired command, such as 'telnetd -l /bin/sh -p 8888'. The device will execute the command, providing a shell access through the specified port.