Triggering RCE using XSS to bypass CSRF in PowerBeam M5 300

Summary

In AirOS 6.1.5 and prior, due to lack of validation is possible to bypass the CSRF in certain web pages. If an authenticated user access an attacker controlled web page, it could trigger the CSRF and the resulting request could modify the device configuration and creating stored-XSS, with the XSS content is possible to bypass the CSRF completely and finally trigger the RCE.

By chaining 4 bugs together, it is possible to cause command injection on a PowerBeam M5 300 using XSS to bypass the implemented form CSRF tokens.