Strforexc

An issue exists in the Logread Lua RPC Plugin within the `/usr/lib/oui-httpd/rpc/logread` file. Specifically, the `logread.set config()` function is susceptible to command injection through the manipulation of the `record size` argument. Command injection is a flaw that allows an attacker to execute arbitrary operating system commands on the affected device.

The Logread Lua RPC plugin contains a command injection flaw. A remote attacker can exploit this by manipulating the `module` argument within the `logread.get system log()` function located in the `/usr/lib/oui-httpd/rpc/logread` file.

A remote injection flaw exists in the plugins.so Native Plugin. The issue resides in the `plugins.set config()` function within the '/cgi-bin/glc' endpoint, allowing a remote attacker to perform an injection attack.

A command injection flaw exists in the `plugins.so` Native Plugin. The issue resides within the `plugins.remove package()` and `plugins.install package()` functions of the '/cgi-bin/glc' endpoint, allowing a remote attacker to execute arbitrary commands.

Remote command injection is possible via the `ovpn-client.get recommend config()` function within the `/cgi-bin/glc` file of the `ovpn-client.so` Native Plugin. This occurs when the `Hostname` argument is manipulated, allowing an attacker to execute arbitrary commands on the system.

Command injection is possible via remote exploitation in the ovpn-client.so Native Plugin. The issue exists within the `ovpn-client.check config()` function located in the `/cgi-bin/glc` file, where manipulating the `filename` argument allows for the execution of arbitrary commands.

The Network Lua RPC Plugin contains a flaw that allows remote command injection. The issue exists within the `network.switch info()` and `network.switch status()` functions located in the `/usr/lib/oui-httpd/rpc/network` file. An attacker can trigger this by manipulating the `switch` argument.

Remote command injection is possible within the s2s.so Native Plugin. The issue exists in the `s2s.enable echo server()` function located in the `/cgi-bin/glc` file. An attacker can trigger this by manipulating the `port` argument, allowing for the execution of arbitrary commands on the system.

A command injection flaw exists in the Tor Proxy Service Configuration Handler. The issue is located within the `replace country()` function in the `/usr/lib/oui-httpd/rpc/tor` library, allowing a remote attacker to execute arbitrary commands.

Remote command injection is possible within the Online Firmware Upgrade Handler component. The issue resides in the `/usr/bin/one click upgrade` file, where improper handling of functionality allows an attacker to execute arbitrary commands remotely.

A command injection issue exists in the LuCI JSON-RPC Interface. A remote attacker can exploit this by manipulating the `rpc sys()` function within the '/cgi-bin/luci/rpc' file.

A command injection flaw exists in the Minidlna Service component. A remote attacker can exploit this by manipulating the `kube.set` argument within the `realpath()` function of the '/rpc' file. Command injection occurs when an application executes arbitrary system commands due to insufficient validation of user-supplied input.

A remote command injection flaw exists in the MTK Backend component within the `iwinfo backend()` function of the `iwinfo.so` file. The issue occurs when the `device` argument is manipulated, allowing an attacker to execute arbitrary commands remotely.

Command injection is possible via a remote attack in the SET USER PWD Handler component. The issue exists within the `FUN 0042e200()` function of the '/cgi-bin/glc' file, where improper manipulation of the `Password` argument allows for the execution of arbitrary commands.

An issue exists in the Path Normalization Handler component within the `/usr/lib/oui-httpd/rpc/` library. A remote attacker can perform command injection by manipulating the `dev name` argument passed to the `dlopen()` function. This allows for the remote execution of arbitrary commands via the `/rpc` endpoint.

A flaw in the FTP Protocol Handler component allows remote command injection. The issue exists within the `snprintf()` function of the `/cgi-bin/glc` file. By manipulating the `media dir` argument via the `/NAS API SET PROTO CONFIG` interface, an attacker can execute arbitrary commands on the system.

Command injection is possible in the OpenVPN Client Import Workflow component via the `ovpnclient.sh` file. This issue allows remote exploitation when malicious OpenVPN configuration files are processed.