Tenda AC6 Command Injection Vulnerability in get_log_file Function

A command injection vulnerability has been identified in the Tenda AC6 V2.0 router, specifically in the firmware version 15.03.06.23. The issue arises in the HTTP daemon (httpd) within the get_log_file function. The vulnerability allows remote attackers to inject operating system commands by manipulating the wans.flag parameter. This is achieved by exploiting how the parameter is processed and executed, potentially leading to unauthorized command execution on the device.

Impact

Exploitation of this vulnerability allows for arbitrary command execution on the affected device.

Reproduction

To reproduce this vulnerability, send a POST request to the /goform/getLogFile endpoint. Include the wans.flag parameter in the request body, formatted to inject a command, such as 'id'. Ensure that the request is made with a valid session cookie.