Rwprimitives

**Name of the Vulnerable Software and Affected Versions** JAIOTlink C492A-W6 version 4.8.30.57701411 **Description** An OS command injection flaw exists where authenticated attackers can achieve remote code execution. By sending a malicious string to the 'NetSDK/Factory SetMAC' HTTP PUT endpoint, an attacker can bypass partial `sscanf()` validation. The attack involves providing a `Wireless` parameter starting with a valid MAC-like prefix followed by a semicolon and a shell payload, which is then passed unsanitized into an `echo` shell command executed via a `system()` wrapper. **Recommendations** At the moment, there is no information about a newer version that contains a fix for this vulnerability. Avoid using the `Wireless` parameter in the 'NetSDK/Factory SetMAC' endpoint until the issue is resolved.