| タイトル | Advantech Technology (China) Co., Ltd. WISE-6610 v1.2.1_20251110 Command Injection |
|---|
| 説明 | Vulnerability Description
A command injection vulnerability exists in the basicstation_apply function of the WISE-6610 industrial gateway.
Vulnerability Impacts
The basicstation_apply function contains a command injection flaw. Attackers can construct malicious input to execute arbitrary system commands on the device with root privileges. Upon successful exploitation, attackers may gain full control of the gateway, modify system configurations, plant backdoors, steal or tamper with network traffic, and even damage the system to render the device inoperable. This poses severe threats to network security and user data.
Vulnerable Interface
The basicstation_apply parameter in the backend module
Vulnerability Analysis
local act = luci.http.formvalue("act")
The act parameter is retrieved from the POST request body. As shown in the screenshot, when the value of the act parameter is set to delete, the program invokes os.execute to run system commands. It also accepts data from the POST packet and passes it to delete_file. No input filtering is performed during the execution of the rm command, allowing arbitrary parameters to be concatenated directly and resulting in command injection. |
|---|
| ソース | ⚠️ https://uvxbywu62qm.feishu.cn/wiki/EzwXwS0vKiroHmk9rqzcjP0EnMe?from=from_copylink |
|---|
| ユーザー | hubdk01 (UID 99481) |
|---|
| 送信 | 2026年07月03日 18:13 (2 月 ago) |
|---|
| モデレーション | 2026年09月07日 07:57 (2 months later) |
|---|
| ステータス | 承諾済み |
|---|
| VulDBエントリ | 399512 [Advantech WISE-6610-NB 1.2.1_20251110 Basic Station Certificate-Deletion basicstation_apply act 特権昇格] |
|---|
| ポイント | 20 |
|---|