| Название | Edimax Edimax BR-6214K Router 1.40 OS Command Injection |
|---|
| Описание | ## Summary
An authenticated OS command injection vulnerability exists in Edimax BR-6214K firmware 1.40. The `pingstr` parameter submitted to `/goform/asp_setPing` is incorporated into a shell command without proper sanitization, allowing an authenticated attacker to execute arbitrary operating system commands.
## Affected Product
- Vendor: Edimax
- Product: Edimax BR-6214K Router
- Affected firmware: 1.40
- Firmware image: `EdiEngBR6214K_1.40.zip`
- Affected endpoint: `/goform/asp_setPing`
- Affected handler: `asp_setPing`
- Affected parameter: `pingstr`
- Authentication: Authenticated administrator or valid web-management credentials are required.
## Vulnerability Type
CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)
## Impact
An authenticated attacker can inject shell metacharacters into a web-management parameter and execute arbitrary operating system commands with the privileges of the Boa web server, which runs as root in the extracted firmware configuration.
## Technical Details
The web page `www/ping.asp` submits to `/goform/asp_setPing`. During route-bound handler verification, `websGetVar("pingstr")` was modeled with a short shell metacharacter payload and execution reached `system()` with the payload embedded in the command string.
- Handler entry address: `0x43bda8`
- Test payload: `;id;#`
- Observed command at system sink: `ping -f -c 4 ;id;# &`
## Proof of Concept
The endpoint requires valid web-management credentials.
```http
POST /goform/asp_setPing HTTP/1.1
Host: <router>
Authorization: Basic <base64-user-pass>
Content-Type: application/x-www-form-urlencoded
pingstr=%3Bid%3B%23
```
Expected command construction during handler execution:
```text
ping -f -c 4 ;id;# &
```
## Evidence
The route-bound verification was performed against the extracted `bin/boa` firmware binary. The verifier used the real handler entry point, real route/handler mapping, real parameter name, and a short payload (`;id;#`) that fits within the corresponding web form input constraints.
## Limitations
The finding is confirmed by route-bound handler execution against the firmware binary using the real URL, real parameter name, short payload, and observed system() command. qemu-user chroot launch of the full Boa service failed with MAP FAIL / SIGSEGV before accepting HTTP requests, so no live HTTP service screenshot is included.
## Suggested CVSS
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H |
|---|
| Источник | ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Edimax-setPing__Edimax__other.md |
|---|
| Пользователь | ST4R0002 (UID 99571) |
|---|
| Представление | 06.07.2026 14:59 (2 месяцы назад) |
|---|
| Модерация | 30.08.2026 20:28 (2 months later) |
|---|
| Статус | принято |
|---|
| Запись VulDB | 397192 [Edimax BR-6214K 1.40 asp_setPing Endpoint www/ping.asp system pingstr эскалация привилегий] |
|---|
| Баллы | 20 |
|---|