firmware

IoData:WFS-SR03 v1.0.3(2022/11/14)

https://www.iodata.jp/lib/software/w/2176.htm

Untitled

Details:

The port where the ioos program is located is 81, which is the interface for the router's processing functions.

sys_smb_pwdmod function parameter controllable in IOS, resulting in arbitrary command injection

Untitled

Parameters are obtained from http parameters, the cgi_sys_pwdmod_handler of the function belongs, and the function name when the url is called pwdmod

Untitled

poc:

need to authorize

<http://127.0.0.1/protocol.csp?fname=system&opt=pwdmod&name=root&pwd1=;id&pwd2=;id&function=set>