| 제목 | Advantech Technology (China) Co., Ltd. WISE-6610 v1.2.1_20251110 Command Injection |
|---|
| 설명 | Vulnerability Description
A command injection vulnerability exists in the nodered_lib_apply function of the WISE-6610 industrial gateway.
Vulnerability Impacts
The nodered_lib_apply function suffers from a command injection flaw. Attackers can construct malicious input to execute arbitrary system commands on the device with root privileges. After successful exploitation, attackers can fully take over the gateway, modify system configurations, implant backdoors, steal or tamper with network traffic, and even damage the operating system to render the device unfunctional. This poses severe risks to network security and user confidential data.
Vulnerable Entry Point
The nodered_lib_apply parameter in backend management modules
Vulnerability Analysis
local act = luci.http.formvalue("act")
The act parameter is fetched from POST request body data. As shown in the source code snippet, when the value of act equals delete, the program calls luci.sys.exec to execute system commands. User-controlled input from the POST payload is passed to the node variable. When executing the rm deletion command, there is no input sanitization or filtering logic. Malicious command characters can be directly concatenated into the system command, leading to command injection. |
|---|
| 원천 | ⚠️ https://uvxbywu62qm.feishu.cn/wiki/RgziwoXf2iD9zKkI4MJcfWcNn7c?from=from_copylink |
|---|
| 사용자 | hubdk01 (UID 99481) |
|---|
| 제출 | 2026. 07. 03. PM 06:48 (2 개월 ago) |
|---|
| 모더레이션 | 2026. 09. 07. AM 07:58 (2 months later) |
|---|
| 상태 | 수락 |
|---|
| VulDB 항목 | 399513 [Advantech WISE-6610-NB 1.2.1_20251110 Node-RED Library nodered_lib_apply act 권한 상승] |
|---|
| 포인트들 | 20 |
|---|