Executive brief
Wavlink AC1200 routers contain a security flaw in the password reset functionality of their management interface. An attacker who has already gained access to the router's administrative credentials can exploit this flaw to execute unauthorized system commands. This could allow a malicious actor to take full control of the device, intercept network traffic, or use the router as a jumping-off point for further attacks within the local network.
Technical details
A command injection vulnerability exists in the Wavlink AC1200 (Model WL-WN532A3) within the 'adm.cgi' binary. The 'set_sys_adm' function, responsible for updating administrative passwords, uses 'sprintf' to construct a shell command that is subsequently executed via 'system()'. While the application attempts to sanitize input by checking for semicolons (;), it fails to account for other shell metacharacters such as '&&' or backticks. An authenticated attacker can provide a specially crafted 'newpass' parameter to execute arbitrary shell commands with the privileges of the web server. This affects firmware versions M32A3_V1410_230602 and M32A3_V1410_240222.
Affected products
- Wavlink WL-WN532A3 (AC1200) Firmware M32A3_V1410_230602, M32A3_V1410_240222
Timeline
- 2025-09-02: advisory: NVD publication date