제출 #869362: Baicells EG3661M (variant EG3661M-NR6 / PhotonID63M) BaiCE_BQ6_2.0.5.3_NA OS Command Injection

An authenticated OS command injection vulnerability exists in the Baicells EG3661M (also marketed as EG3661M-NR6 / PhotonID63M) running firmware BaiCE_BQ6_2.0.5.3_NA. The flaw is in the network diagnostic endpoints diagnosis_route and diagnosis_ping of the LuCI web management interface, reachable at /cgi-bin/luci/;stok=<session>/admin/system/.

The handlers build traceroute and ping command lines from request parameters and pass them to a shell without input validation or neutralization of shell metacharacters. Injecting a pipe character into an affected parameter terminates the intended command and executes attacker-supplied commands. Confirmed injection points: parameters MaxHops and Timeout on diagnosis_route, and parameter Size on diagnosis_ping.

Commands execute with the privileges of the web server, which runs as root, leading to full device compromise. Exploitation requires a valid authenticated administrative session (the stok path token and the sysauth cookie) and is performed remotely over HTTP. Exploitation was demonstrated by obtaining an interactive root reverse shell (BusyBox ash, uid=0) and reading /etc/shadow; the admin and administrator accounts were recovered as the documented factory default.

Vulnerability type: OS Command Injection (CWE-78). CVSS 3.1 base score 7.2 (High), vector AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H.

Mitigation: validate and bound all diagnostic parameters, execute ping and traceroute without a shell (argument array or library calls), reject shell metacharacters, and run the web interface without root privileges.

• 원천: ⚠️ https://github.com/actuator/cve/blob/main/Baicells/EG3661M.md
• 사용자: Actuator (UID 67941)
• 제출: 2026. 06. 25. PM 01:14 (2 개월 ago)
• 모더레이션: 2026. 08. 13. PM 07:17 (2 months later)
• 상태: 수락
• VulDB 항목: 389685 [Baicells EG3661M BaiCE_BQ6_2.0.5.3_NA LuCI Web Interface /cgi-bin/luci MaxHops/Timeout/Size 권한 상승]
• 포인트들: 20