Critical · published February 27, 2025
🚨 An unauthenticated attacker can issue commands as root on vulnerable Tuoshi/Dionlink devices—no hacking tools required! 🔥 It's like a hotel front desk that lets anyone check into any room without identification—once inside, they can do whatever they want. Imagine the chaos if someone could wander into the manager's suite and start changing orders! With this command injection vulnerability, an attacker could gain root access to your device, allowing them to install malware, steal sensitive data, or even take control of your entire network. The potential fallout is absolutely devastating if these devices are part of your home or business setup!
It's like a hotel front desk that lets anyone check into any room without identification—once inside, they can do whatever they want. Imagine the chaos if someone could wander into the manager's suite and start changing orders! The vulnerability exists in the /goform/formJsonAjaxReq endpoint, which fails to sanitize shell metacharacters in JSON parameters. This oversight allows attackers to inject and execute arbitrary OS commands with root privileges.
With this command injection vulnerability, an attacker could gain root access to your device, allowing them to install malware, steal sensitive data, or even take control of your entire network. The potential fallout is absolutely devastating if these devices are part of your home or business setup! Immediately patch your devices to the latest firmware versions: M7628NNxlSPv2xUI_v1.0.1802.10.08_P4 or M7628xUSAxUIv2_v1.0.1481.15.02_P0. Additionally, restrict network access to these devices to trusted users only, and consider changing default passwords. 🛡️ You've got this! Stay proactive, and these vulnerabilities will be locked down in no time! 🚀