| Titel | Edimax Edimax BR-6214K Router 1.40 OS Command Injection |
|---|
| Beschreibung | ## Summary
An authenticated OS command injection vulnerability exists in Edimax BR-6214K firmware 1.40. The `ateFunc` parameter submitted to `/goform/asp_WlanMP` is incorporated into a shell command without proper sanitization, allowing an authenticated attacker to execute arbitrary operating system commands.
## Affected Product
- Vendor: Edimax
- Product: Edimax BR-6214K Router
- Affected firmware: 1.40
- Firmware image: `EdiEngBR6214K_1.40.zip`
- Affected endpoint: `/goform/asp_WlanMP`
- Affected handler: `asp_WlanMP`
- Affected parameter: `ateFunc`
- Authentication: Authenticated administrator or valid web-management credentials are required.
## Vulnerability Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
## Impact
An authenticated attacker can inject shell metacharacters into a web-management parameter and execute arbitrary operating system commands with the privileges of the Boa web server, which runs as root in the extracted firmware configuration.
## Technical Details
The web page `www/wlanMP.asp` submits to `/goform/asp_WlanMP`. During route-bound handler verification, `websGetVar("ateFunc")` was modeled with a short shell metacharacter payload and execution reached `system()` with the payload embedded in the command string.
- Handler entry address: `0x45e40c`
- Test payload: `;id;#`
- Observed command at system sink: `/bin/rftest.sh ;id;#`
## Proof of Concept
The endpoint requires valid web-management credentials.
```http
POST /goform/asp_WlanMP HTTP/1.1
Host: <router>
Authorization: Basic <base64-user-pass>
Content-Type: application/x-www-form-urlencoded
ateFunc=%3Bid%3B%23&ateGain=10&ateTxCount=1000&ateChan=1&ateRate=0
```
Expected command construction during handler execution:
```text
/bin/rftest.sh ;id;#
```
## Evidence
The route-bound verification was performed against the extracted `bin/boa` firmware binary. The verifier used the real handler entry point, real route/handler mapping, real parameter name, and a short payload (`;id;#`) that fits within the corresponding web form input constraints.
## Limitations
The finding is confirmed by route-bound handler execution against the firmware binary using the real URL, real parameter name, short payload, and observed system() command. qemu-user chroot launch of the full Boa service failed with MAP FAIL / SIGSEGV before accepting HTTP requests, so no live HTTP service screenshot is included.
## Suggested CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|---|
| Quelle | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Edimax-WlanMP__Edimax__other.md |
|---|
| Benutzer | ST4R0002 (UID 99571) |
|---|
| Einreichung | 06.07.2026 14:56 (vor 2 Monaten) |
|---|
| Moderieren | 30.08.2026 20:27 (2 months later) |
|---|
| Status | Akzeptiert |
|---|
| VulDB Eintrag | 397191 [Edimax BR-6214K 1.40 asp_WlanMP Endpoint www/wlanMP.asp system ateFunc erweiterte Rechte] |
|---|
| Punkte | 20 |
|---|