OS Command Injection in WAVLINK WN701AE Router

Executive Summary

This vulnerability is an authenticated command injection flaw in the WAVLINK WN701AE router's ioos web backend, specifically in the del_vlan_group function. The vlan_name parameter is not properly sanitized before being used in a system() call, allowing attackers to inject arbitrary commands with root privileges.

Useful 0 Not Useful 0

Detection Guidance

To detect this vulnerability, check if your WAVLINK WN701AE router is running firmware version M01AE_V260105. Inspect network traffic for HTTP requests targeting the ioos web backend with the del_vlan_group function. Look for requests containing suspicious vlan_name parameters with command injection payloads like semicolons or pipes.

Useful 0 Not Useful 0

Impact Analysis

An attacker could gain full control over the device, intercept network traffic, modify firmware to create persistent backdoors, move laterally within the network, or use the device in botnet attacks. Exploitation requires authentication but allows command execution with highest privileges.

Useful 0 Not Useful 0

Mitigation Strategies

Immediately update the router firmware to a patched version if available. Disable remote access to the web interface if not required. Restrict network access to the device and monitor for unusual activity. Consider isolating the device from critical network segments until patched.

Useful 0 Not Useful 0