WN579X3 D(en).md

The authenticated command injection vulnerability in the port_forward function of /cgi-bin/wapi.cgi on the WAVLINK WN579X3-D router (firmware version M79X3D.V250402) can be exploited through the controllable name parameter, leading to remote code execution with root privileges.

An authenticated attacker can inject arbitrary shell commands through the destination parameter and execute them with the privileges of the web service, potentially resulting in full compromise of the device.

Vulnerability Details

The vulnerability is triggered in the sub_405B5C function, involving the user-controlled name parameter. The input validation performed by sub_4169A0 is based on a weak blacklist mechanism that fails to block many dangerous special characters, allowing attackers to easily bypass the filter. The unsanitized input is then copied via strncpy(v51, v26, 31) , used to construct a system command through snprintf , and finally executed by popen , resulting in an OS command injection vulnerability.

It only performs login verification and Referer checking.

The Referer check in sub_402224 is virtually useless / effectively nonexistent.

To bypass the check, avoid the following two conditions:

The string "html" appears exactly 2 times in the Referer.

The string "html" appears exactly 1 time and the string "main" appears exactly 1 time in the Referer.

Then proceed down the function=set branch.

Now we arrive at the injectable name parameter. The function sub_4169A0 acts as a blacklist filter that performs string validation on the user-supplied name input.

Only backticks (```) and semicolons ( ; ) are filtered. This is the weakness. As a result, we can still use other characters such as `|`, `>`, `&`, etc. to bypass the filter and construct command injection payloads. Further down, the `popen` function is called to execute the constructed command.

First, log in to obtain a valid cookie.