| タイトル | Shenzhen Aitemi M300 Wifi Repeater r0-ea7890a Command Injection |
|---|
| 説明 | # m300 smacfilter name command injection
Command injection vulnerability located on the MT02 M300 WIRELESS-N REPEATER. The WIRELESS-N REPEATER takes in parameters to the `/protocol.csp` endpoint and the `name` parameter is vulnerable to command injection and buffer overflows. User has full control of the `name` field which gets appended to the busybox shell command `uci set firewall.smacfilter%d.name=` through `sprintf()`. A similar call to system, `doSystemComLib()` is called with a parameter of the command, leading to command injection by an unauthenticated user on the MT02 M300 WIRELESS-N REPEATER. The targeted binary `commuos` runs as root leading to full system compromise.
## Version
```
Linux version 4.4.194 (luotao@wisewish) (gcc version 5.4.0 (LEDE GCC 5.4.0 r0-ea7890a) ) #0 Thu Apr 18 02:51:26 2024
```
*The software running on the repeater is not known to be updated from OSINT collections*
### Bug 1: Name parameter in SMACFilterRules:
```
name_param_value = (char *)get_params_value(request_parameters,"name");
.
.
.
sprintf(stack_smac_command,"uci set firewall.smacfilter%d.name=%s",section,name_param_value);
```
### POC for Mac Command Injection:
```
http://192.168.11.1/protocol.csp?fname=net&opt=smacfilter_conf&function=set&act=add&name=test;%20touch%201&enable=1&mac=44:44:44:44:44:44
```
The above POC will create a file named `1` in the `/` directory. The command `touch 1` is appended to the name parameter above. This can be replaced by any command the busybox ash shell supports for execution by an unauthenticated remote user.
|
|---|
| ソース | ⚠️ https://github.com/IEATASICS/m300-repeater-bugs |
|---|
| ユーザー | metermult (UID 99212) |
|---|
| 送信 | 2026年06月22日 21:24 (2 月 ago) |
|---|
| モデレーション | 2026年08月08日 15:57 (2 months later) |
|---|
| ステータス | 重複 |
|---|
| VulDBエントリ | 387184 [Shenzhen Aitemi M300 Wi-Fi Repeater r0-ea7890a sprintf enable/name/mac 特権昇格] |
|---|
| ポイント | 0 |
|---|