提出 #869362: Baicells EG3661M (variant EG3661M-NR6 / PhotonID63M) BaiCE_BQ6_2.0.5.3_NA OS Command Injection

An authenticated OS command injection vulnerability exists in the Baicells EG3661M (also marketed as EG3661M-NR6 / PhotonID63M) running firmware BaiCE_BQ6_2.0.5.3_NA. The flaw is in the network diagnostic endpoints diagnosis_route and diagnosis_ping of the LuCI web management interface, reachable at /cgi-bin/luci/;stok=<session>/admin/system/.

The handlers build traceroute and ping command lines from request parameters and pass them to a shell without input validation or neutralization of shell metacharacters. Injecting a pipe character into an affected parameter terminates the intended command and executes attacker-supplied commands. Confirmed injection points: parameters MaxHops and Timeout on diagnosis_route, and parameter Size on diagnosis_ping.

Commands execute with the privileges of the web server, which runs as root, leading to full device compromise. Exploitation requires a valid authenticated administrative session (the stok path token and the sysauth cookie) and is performed remotely over HTTP. Exploitation was demonstrated by obtaining an interactive root reverse shell (BusyBox ash, uid=0) and reading /etc/shadow; the admin and administrator accounts were recovered as the documented factory default.

Vulnerability type: OS Command Injection (CWE-78). CVSS 3.1 base score 7.2 (High), vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Mitigation: validate and bound all diagnostic parameters, execute ping and traceroute without a shell (argument array or library calls), reject shell metacharacters, and run the web interface without root privileges.

• ソース: ⚠️ https://github.com/actuator/cve/blob/main/Baicells/EG3661M.md
• ユーザー: Actuator (UID 67941)
• 送信: 2026年06月25日 13:14 (2 月 ago)
• モデレーション: 2026年08月13日 19:17 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 389685 [Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA LuCI Web Interface /cgi-bin/luci MaxHops/Timeout/Size 特権昇格]
• ポイント: 20