Credits to me ( finding rce ) and nitrix ( showing me router and helping out when i was stumped )
An authenticated command injection vulnerability exists in the DVG-N5402GF router.
The Ping diagnostic page fails to sanitize user input, allowing arbitrary command execution as root.
- Vendor: D-Link
- Model: DVG-N5402GF
- Component: Login -> Maintenance -> Diagnostics -> Ping Test
- Fofa Query:
"D-Link VoIP Wireless Router"
The Ping Destination parameter is passed directly to a shell command with little filtering. The filtering can just be wiped with using anything with letters, example localhost.
Example payload:
localhost;echo hi
This will execute echo hi ( duh ) with full superuser priviliges.
