提出 #881276: Edimax Edimax BR-6214K Router 1.40 OS Command Injection

## Summary

An authenticated OS command injection vulnerability exists in Edimax BR-6214K firmware 1.40. The `pingstr` parameter submitted to `/goform/asp_setPing` is incorporated into a shell command without proper sanitization, allowing an authenticated attacker to execute arbitrary operating system commands.

## Affected Product

- Vendor: Edimax
- Product: Edimax BR-6214K Router
- Affected firmware: 1.40
- Firmware image: `EdiEngBR6214K_1.40.zip`
- Affected endpoint: `/goform/asp_setPing`
- Affected handler: `asp_setPing`
- Affected parameter: `pingstr`
- Authentication: Authenticated administrator or valid web-management credentials are required.

## Vulnerability Type

CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)

## Impact

An authenticated attacker can inject shell metacharacters into a web-management parameter and execute arbitrary operating system commands with the privileges of the Boa web server, which runs as root in the extracted firmware configuration.

## Technical Details

The web page `www/ping.asp` submits to `/goform/asp_setPing`. During route-bound handler verification, `websGetVar("pingstr")` was modeled with a short shell metacharacter payload and execution reached `system()` with the payload embedded in the command string.

- Handler entry address: `0x43bda8`
- Test payload: `;id;#`
- Observed command at system sink: `ping -f -c 4 ;id;# &`

## Proof of Concept

The endpoint requires valid web-management credentials.

```http
POST /goform/asp_setPing HTTP/1.1
Host: <router>
Authorization: Basic <base64-user-pass>
Content-Type: application/x-www-form-urlencoded

pingstr=%3Bid%3B%23
```

Expected command construction during handler execution:

```text
ping -f -c 4 ;id;# &
```

## Evidence

The route-bound verification was performed against the extracted `bin/boa` firmware binary. The verifier used the real handler entry point, real route/handler mapping, real parameter name, and a short payload (`;id;#`) that fits within the corresponding web form input constraints.

## Limitations

The finding is confirmed by route-bound handler execution against the firmware binary using the real URL, real parameter name, short payload, and observed system() command. qemu-user chroot launch of the full Boa service failed with MAP FAIL / SIGSEGV before accepting HTTP requests, so no live HTTP service screenshot is included.

## Suggested CVSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• ソース: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Edimax-setPing__Edimax__other.md
• ユーザー: ST4R0002 (UID 99571)
• 送信: 2026年07月06日 14:59 (2 月 ago)
• モデレーション: 2026年08月30日 20:28 (2 months later)
• ステータス: 承諾済み
• VulDBエントリ: 397192 [Edimax BR-6214K 1.40 asp_setPing Endpoint www/ping.asp system pingstr 特権昇格]
• ポイント: 20