Wavlink NU516U1 Command Injection Vulnerability in wzdrepeater Function

A command injection vulnerability has been identified in the Wavlink NU516U1 USB Network Printer Server, specifically in the M16U1_V240425 firmware. The issue arises in the wzdrepeater function of the /cgi-bin/adm.cgi file, where user-supplied arguments can be manipulated to execute arbitrary operating system commands. This vulnerability can be exploited remotely.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the /cgi-bin/adm.cgi endpoint with the 'sel_Automode' parameter set to a crafted command, such as '$(telnetd -l /bin/sh -p 8889)'. Include the 'wlan_bssid' and other required parameters as part of the request. The device will execute the injected command, such as starting a telnet server on port 8889, providing a shell access.