| शीर्षक | Wavlink WL-WN530BE1-A M30BE1_V251117 Command Injection |
|---|
| विवरण | CWE-78
Finding: wavlink-uploadvpn-du-popen-http-20260729
Summary: On July 29, 2026, a fresh multipart POST to /cgi-bin/uploadVpn.cgi?type=wireguard used group='grp2;id>/tmp/cmdproof_0756' and returned HTTP 500, but independent read-back of the live recovery-rootfs file artifacts/rootfs/tmp/cmdproof_0756 immediately after that same request showed uid=0(root) gid=0(root) groups=0(root). This independently confirms root command execution through the du -sh %s popen sink; the HTTP body was not used as the state-change proof. Required screenshots were captured under findings/wavlink-uploadvpn-du-popen-http-20260729/screenshots/, and report.md was written under findings/wavlink-uploadvpn-du-popen-http-20260729/report.md.
Reproduction: see report.md / poc / dynamic_verification.txt |
|---|
| स्रोत | ⚠️ https://gist.github.com/Rauzk/0a61823f0033441142dc1c3f4a776e7c |
|---|
| उपयोगकर्ता | Tarbely (UID 99399) |
|---|
| सबमिशन | 30/07/2026 01:19 AM (3 महीनों पहले) |
|---|
| संयम | 12/10/2026 10:33 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 416859 [Wavlink WL-WN530BE1-A 251117 /cgi-bin/uploadVpn.cgi popen type अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|