Post-authentication command injection in Wavlink AC1200 adm.cgi set_sys_adm

A successful exploit allows an authenticated attacker to inject and execute arbitrary system commands in the context of the vulnerable device's web management process while resetting the password. This can result in full compromise of the device, including unauthorized configuration changes, credential manipulation, persistence, service disruption, and potential use of the router as a foothold for further activity on the local network.

Restrict access to the administrative interface to trusted management networks only, disable remote administration if not strictly required, and ensure strong unique credentials are used to reduce the likelihood of authenticated abuse. Monitor for unexpected password reset events or suspicious command execution behavior on the device. Where possible, place the device behind network controls that limit access to the web management interface until patched firmware is deployed.

Upgrade to a vendor-fixed firmware version if one is available from Wavlink. The vulnerable firmware versions identified in the provided content are M32A3_V1410_230602 and M32A3_V1410_240222, so remediation requires moving to a version that corrects input handling in adm.cgi, specifically in set_sys_adm, by properly sanitizing or safely handling the newpass parameter. If no fixed release is currently available, the information is currently not available beyond avoiding use of affected firmware in exposed management environments.