| タイトル | Wavlink NU516U1 V240425 Command Injection |
|---|
| 説明 | # Remote Command Execution Vulnerability in Wavlink NU516U1 (V240425) via "firmware_url" Parameter in "ota_new_upgrade" Function in "adm.cgi" Component
#### Overview
- **Vendor:** Wavlink
- **Product:** NU516U1
- **Version:** WAVLINK-NU516U1-WO-A-2024-04-25-b516aec-GDBYFM (V240425)
- **Product Type:** USB Printer Server
- **Vulnerability Type:** Command Injection
- **Firmware Download:** `https://docs.wavlink.xyz/Firmware/?category=USB+Printer+Server&model=WL-NU516U1-A`
- **Default Password:** admin
#### Vulnerability Description
A severe command injection vulnerability exists in the `/cgi-bin/adm.cgi` component of the Wavlink NU516U1 router firmware (Version V240425). The vulnerability is located in the `sub_405AF4` function, which handles the OTA online upgrade (`ota_new_upgrade`) functionality. When processing the `firmware_url` parameter, the vendor directly concatenates it into a system command. Although the developer attempted to wrap the parameter in double quotes to prevent argument escape, this defense mechanism cannot prevent Shell Command Substitution. An authenticated remote attacker can execute arbitrary system commands by crafting a malicious `firmware_url` parameter containing `$()` or backticks, bypassing restrictions and gaining full Root control of the device. |
|---|
| ユーザー | haimianbaobao (UID 94979) |
|---|
| 送信 | 2026年02月09日 15:09 (8 月 ago) |
|---|
| モデレーション | 2026年03月05日 19:20 (24 days later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 349220 [Wavlink WL-NU516U1 V240425 OTA Online Upgrade /cgi-bin/adm.cgi sub_405AF4 firmware_url 特権昇格] |
|---|
| ポイント | 20 |
|---|