Gửi #881275: Edimax Edimax BR-6214K Router 1.40 OS Command Injection

## Summary

An authenticated OS command injection vulnerability exists in Edimax BR-6214K firmware 1.40. The `ateFunc` parameter submitted to `/goform/asp_WlanMP` is incorporated into a shell command without proper sanitization, allowing an authenticated attacker to execute arbitrary operating system commands.

## Affected Product

- Vendor: Edimax
- Product: Edimax BR-6214K Router
- Affected firmware: 1.40
- Firmware image: `EdiEngBR6214K_1.40.zip`
- Affected endpoint: `/goform/asp_WlanMP`
- Affected handler: `asp_WlanMP`
- Affected parameter: `ateFunc`
- Authentication: Authenticated administrator or valid web-management credentials are required.

## Vulnerability Type

CWE-78: Improper Neutralization of Special Elements used in an OS Command (OS Command Injection)

## Impact

An authenticated attacker can inject shell metacharacters into a web-management parameter and execute arbitrary operating system commands with the privileges of the Boa web server, which runs as root in the extracted firmware configuration.

## Technical Details

The web page `www/wlanMP.asp` submits to `/goform/asp_WlanMP`. During route-bound handler verification, `websGetVar("ateFunc")` was modeled with a short shell metacharacter payload and execution reached `system()` with the payload embedded in the command string.

- Handler entry address: `0x45e40c`
- Test payload: `;id;#`
- Observed command at system sink: `/bin/rftest.sh ;id;#`

## Proof of Concept

The endpoint requires valid web-management credentials.

```http
POST /goform/asp_WlanMP HTTP/1.1
Host: <router>
Authorization: Basic <base64-user-pass>
Content-Type: application/x-www-form-urlencoded

ateFunc=%3Bid%3B%23&ateGain=10&ateTxCount=1000&ateChan=1&ateRate=0
```

Expected command construction during handler execution:

```text
/bin/rftest.sh ;id;#
```

## Evidence

The route-bound verification was performed against the extracted `bin/boa` firmware binary. The verifier used the real handler entry point, real route/handler mapping, real parameter name, and a short payload (`;id;#`) that fits within the corresponding web form input constraints.

## Limitations

The finding is confirmed by route-bound handler execution against the firmware binary using the real URL, real parameter name, short payload, and observed system() command. qemu-user chroot launch of the full Boa service failed with MAP FAIL / SIGSEGV before accepting HTTP requests, so no live HTTP service screenshot is included.

## Suggested CVSS

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

• Nguồn: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/Edimax-WlanMP__Edimax__other.md
• Người dùng: ST4R0002 (UID 99571)
• Đệ trình: 06/07/2026 14:56 (cách đây 2 các tháng)
• Kiểm duyệt: 30/08/2026 20:27 (2 months later)
• Trạng thái: được chấp nhận
• Mục VulDB: 397191 [Edimax BR-6214K 1.40 asp_WlanMP Endpoint www/wlanMP.asp system ateFunc nâng cao đặc quyền]
• điểm: 20