| शीर्षक | Wavlink WL-WN530BE2-A M30BE2_V250604 CWE-78 |
|---|
| विवरण | A Remote Command Injection (RCE) vulnerability exists in the api.cgi binary, specifically within the info handler and the login processing function sub_12580. An unauthenticated attacker can manipulate the REMOTE_ADDR environment variable—obtained via getenv()—and inject arbitrary shell commands into a system call constructed using sprintf() and executed with system(). Since no input sanitization, validation, or escaping is performed prior to command execution, this flaw allows attackers to execute arbitrary operating system commands with the privileges of the web server process. |
|---|
| स्रोत | ⚠️ https://github.com/F-yyjy/cve/blob/main/WN530BE2-A_api-cgi.md |
|---|
| उपयोगकर्ता | yyjy (UID 100438) |
|---|
| सबमिशन | 10/08/2026 11:33 AM (2 महीनों पहले) |
|---|
| संयम | 15/10/2026 11:31 AM (2 months later) |
|---|
| स्थिति | स्वीकृत |
|---|
| VulDB प्रविष्टि | 420570 [Wavlink WL-WN530BE2-A तक M30BE2_V250604 Login Processing api.cgi sub_12580 REMOTE_ADDR अधिकार वृद्धि] |
|---|
| अंक | 20 |
|---|