Tenda AC6 Command Injection Vulnerability in formWifiApScan Function

A command injection vulnerability has been identified in the Tenda AC6 V2.0 router, specifically in the firmware version 15.03.06.23. The issue arises in the formWifiApScan function of the httpd component, where the 'wl2g.public.country' and 'wl5g.public.country' parameters are processed without proper input validation. This flaw allows remote attackers to inject and execute arbitrary operating system commands.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the device's operating system.

Reproduction

To reproduce this vulnerability, send a POST request to '/goform/WifiApScan' with a valid session cookie. Include the 'wl2g.public.country' or 'wl5g.public.country' parameter with a payload that injects a command, such as 'id'.