H0Lyduck

The issue concerns an os command injection vulnerability. It is related to the `/goform/set cmd` endpoint and the `websGetVar` variable.

The issue concerns an os command injection vulnerability, specifically affecting the `/goform/set blacklist` endpoint, where the `mac` and `enable` variables are involved.

A critical issue was found in the function `websGetVar` of the file `/goform/set manpwd`. The manipulation of the argument `routepwd` leads to os command injection. It is possible to launch the attack remotely. The exploit has been disclosed to the public.