Posted by disclosure via Fulldisclosure on Oct 20 0day Rubbish Research Team is publicly disclosing a vulnerability in the

Edimax BR-6478AC, firmware image BR6478AC_v2.20.bin, the dual-band AC1750 SOHO

wireless router from Edimax Technology Co., Ltd. (Taiwan). A single

authenticated POST that looks like an ordinary WAN settings submission reaches

system() with a request-controlled username interpolated unquoted into a shell

command line, behind a sanitiser that inspects exactly one character,...