Weiming Shi

An issue exists in the netfilter `arp tables` component regarding the parsing of ARP payloads for IEEE1394 (FireWire) interfaces. The `arp packet match()` function incorrectly assumes that both source and target hardware addresses are present, whereas IPv4-over-IEEE1394 ARP (RFC 2734) omits the target hardware address. This causes the function to read incorrect bytes for target device address and target IP address comparisons, leading to incorrect filtering decisions where packets may be dropped or accepted erroneously. Additionally, the `arpt mangle` function uses linear pointer arithmetic that miscalculates the offset for the target IP address on IEEE1394 devices. This results in mangling operations writing to the wrong memory location, causing packet corruption.

A flaw exists in the netfilter x tables component where `xt match` and `xt target` structures registered with `NFPROTO UNSPEC` can be loaded by any protocol family via `nft compat`. When these structures use a bitmask with `NF INET *` constants to restrict hooks, the validation incorrectly passes for the ARP protocol because `NF ARP OUT` shares the same value as `NF INET LOCAL IN`. This allows matches to execute on ARP chains where expected hook assumptions are not met, potentially leading to NULL pointer dereferences, as seen in the `devgroup mt()` function.

The issue is related to command injection in the system mgr.cgi component, which can lead to remote arbitrary code execution. This occurs due to errors in neutralizing special elements in the OS command. The exploitation of this issue can allow a remote attacker to execute arbitrary code.